Comment # 6
on bug 10959
from Alexis La Goutte
(In reply to boaz.brickner from comment #5)
> I understand why Wireshark prefers to keep things simple and stops
> dissecting in this case.
> FWIW, I believe that each packet should be parsed with the length it is
> written with, not with the theoretical length it should be.
> For example, if there's a new RFC allowing an option to be in a different
> length, the new option would break other options parsing.
> Wireshark handles a lot of cases of unknown or invalid parts in the packet
> without stop the dissection.
> But, to repeat my first sentence, I fully understand why you prefer to keep
> it simple here.
Yes, i can "start" to dissect packet but you will be get a malformed packet
(and may be no decode the rest of payload...)
You are receiving this mail because:
- You are watching all bug changes.