https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7061
--- Comment #10 from Pascal Quantin <pascal.quantin@xxxxxxxxx> 2012-04-11 11:54:56 PDT ---
(In reply to comment #9)
> (In reply to comment #7)
> > Two small questions:
> >
> > - Why is your heuristic dissector returning:
> > return tvb_length(tvb);
> > instead of:
> > return TRUE;
> > ?
> I followed multiple packet dissectors some of which are non-heuristic.Should I
> change it to TRUE?
Yes please.
>
> >
> > - Can you have a packet bigger than 12 bytes? You only dissect 12 bytes so it
> > could allow to narrow the heuristics.
>
> Yes, we can have BFCP packet bigger than 12 bytes.
>
> Header - 12 bytes
> Payload - depends on 'payload_length' in header.
>
> As of now I am only dissecting header, and thinking to add complete message
> dissection code in next iteration.
OK, thanks for the info. Maybe you could add the payload dump until it is fully
decoded? Something like (untested):
if (tvb_length_remaining(tvb, BFCP_OFFSET_PAYLOAD) > 0)
proto_tree_add_item(tree, hf_bfcp_payload, tvb, BFCP_OFFSET_PAYLOAD,
bfcp_payload_length, ENC_NA);
(...)
{ &hf_bfcp_payload,
{ "Payload", "bfcp.payload", FT_BYTES, BASE_NONE, NULL, 0x0, NULL,
HFILL }
},
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.