Ethereal-dev: Re: [Ethereal-dev] Having an invisible field on the TCP header giving number of

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Richard Sharpe <rsharpe@xxxxxxxxxx>
Date: Sat, 20 Apr 2002 14:42:40 +0930 (CST)
On Fri, 19 Apr 2002, Scott Renfro wrote:

> On Sat, Apr 20, 2002 at 06:35:07AM +0930, Richard Sharpe wrote:
> > 
> > When trying to analyse a trace recently, I wanted to mark no-data ACKs
> > differently so I could ignore them or see the patters, and I found
> > myself doing something like ip.len==40, which is not nice.
> 
> hmm; tcp (subject line) or ip (body)?  I always do tcp.flags.push==1 to
> only show packets with data.  I agree that there isn't an easy way to
> grab ip packets with tcp or udp data.

Well, I want to be able to mark TCP segments that have no data.

Another reason for wanting the tcp.datalen header field is that the actual 
size of a no-data packet depends on options. Under Linux 2.4.x it is 52 
bytes.

Regards
-----
Richard Sharpe, rsharpe@xxxxxxxxxx, rsharpe@xxxxxxxxx, 
sharpe@xxxxxxxxxxxx