Ethereal-dev: Re: [Ethereal-dev] Having an invisible field on the TCP header giving number of

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 20 Apr 2002 02:20:19 -0700
On Fri, 19 Apr 2002, Scott Renfro wrote:
> hmm; tcp (subject line) or ip (body)?  I always do tcp.flags.push==1 to
> only show packets with data.

There's no guarantee that a TCP segment with data necessarily has PSH
set.  That may be the way a lot of TCP implementations work, but I think
I have seen TCP segments with data but with PSH not set.

In addition, somebody might want the length - see, for example, the
statistics that Phil Williams wanted to gather; yes, he can compute the
TCP payload length from the IP total length, IP header length, and TCP
header length, but if we're going to have a field to specify whether a
TCP segment has any payload, we might as well have it specify how much
payload it has.

> I agree that there isn't an easy way to grab ip packets with tcp or
> udp data.

Yes, it might be useful to have a "udp.len" field as well.