[Dinesh G Dutt <ddutt@xxxxxxxxx>]

Guy Harris writes:
 > 
 > On Oct 21, 2003, at 1:30 PM, Dinesh G Dutt wrote:
 > 
 > > The basic problem has to do with marking a frame as a "Malformed 
 > > Frame". It is
 > > possible with the MDS family of switches & analyzer adapters to 
 > > truncate frames
 > > delivered to Ethereal to prevent fewer frame drops and for other
 > > reasons.
 > 
 > That sounds as if it's the same thing as the snapshot length when 
 > capturing; the only difference is that the actual frame length isn't 
 > made available, so the frames show up as "Malformed" rather than 
 > "Short".  Ideally, there'd be some way to get the actual frame length, 
 > in which case the frame would be reported as "Short".
You're right. With newer versions of the feature, it is possible to get the
actual frame length as part of the packet (for example it is a field in the
Boardwalk header). 

 > > It would be slow and bad for readability to check for every field if 
 > > there are
 > > sufficient bytes present.
 > 
 > We do that in other places; are you certain it'd really be that bad to 
 > do it in the SCSI dissector?
For every single field ? I've seen lengths all over from 2 bytes to 48 bytes
sent by initiators which means every single field needs to be checked. I
personally think it'd affect readability and possibly performance (especially
on large traces). Is there a more elegant way to fix this issue ? If not and if
checking every field is the option, I'll do it. 

 > The two cases you present are different.
I agree. 

Dinesh
-- 
I am not young enough to know everything. - Oscar Wilde