Hi all,
It is true indeed that many current TCP implementations do *not* set the PSH
flag correctly. I *used* to filter on 'tcp.flags.psh == 1' for checking
segments containing data, but I always lacked data this way. Having this
tcp.len field, will definitely help a lot!
Regards,
Olivier
: -----Original Message-----
: From: Richard Sharpe [mailto:rsharpe@xxxxxxxxxx]
: Sent: zondag 21 april 2002 7:12
: To: Guy Harris
: Cc: ethereal-dev@xxxxxxxxxxxx
: Subject: Re: [Ethereal-dev] Having an invisible field on the
: TCP header
: giving number of bytes
:
:
: On Sat, 20 Apr 2002, Guy Harris wrote:
:
: > On Sat, Apr 20, 2002 at 06:35:07AM +0930, Richard Sharpe wrote:
: > > When trying to analyse a trace recently, I wanted to mark
: no-data ACKs
: > > differently so I could ignore them or see the patters,
: and I found myself
: > > doing something like ip.len==40, which is not nice.
: > >
: > > So, does anyone have any objections,
: >
: > I don't - it sounds reasonable and useful.
: >
: > > or suggestions about what the field should be?
: >
: > It should be the TCP payload length in the segment; I'd call it
: > "tcp.len".
:
: OK, added, and tested now. It works. It might not be in the most
: appropriate place.
:
: Regards
: -----
: Richard Sharpe, rsharpe@xxxxxxxxxx, rsharpe@xxxxxxxxx,
: sharpe@xxxxxxxxxxxx
:
:
: _______________________________________________
: Ethereal-dev mailing list
: Ethereal-dev@xxxxxxxxxxxx
: http://www.ethereal.com/mailman/listinfo/ethereal-dev
: