[Guy Harris <guy@xxxxxxxxxxxx>]

jose alonso wrote:

> the capture is from Ethereal. The octets contain the length of the rest 
> of the packet (i don't need decode this info,

Yes, you do.

TCP provides a byte stream service, not a packet service.  Therefore, 
many protocols that send packets over TCP precede the packet with a 
length value, so that the code receiving the packets knows how big they 
are.  There is no guarantee that a packet sent over TCP begins or ends 
on TCP segment boundaries.

Therefore, you want a disssector to parse the length value, and to 
handle packet boundaries (you can use tcp_dissect_pdus() for this).

> Do you suggest write a dissector?

Yes.

> isn't there a more direct (easy) solution?

No.
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users