Wireshark-dev: Re: [Wireshark-dev] Check for end of packet?

From: "Kevin A. Noll" <spamknoll@xxxxxxxxxxxxx>
Date: Wed, 09 May 2007 15:31:09 -0400

Guy,

You're asking me a question I don't think I know how to answer (darned
amateurs :-).

The dissector in question is packet-wlccp.c. 

Regarding heuristic or not, I still don't fully understand what the
difference is. I don't think this one is heuristic, and this should be the
top layer protocol, so I wouldn't need to hand it off to another recipient.


--kan--

--
Kevin A. Noll, KD4WOZ
CCIE, CCDP
Versatile, Inc.		
Kevin.Noll@xxxxxxxxxxxxx
+1-717-796-1936

-----Original Message-----
From: wireshark-dev-bounces@xxxxxxxxxxxxx
[mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Guy Harris
Sent: Wednesday, May 09, 2007 3:06 PM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] Check for end of packet?

Kevin A. Noll wrote:
> 
> I know this should be easy to do, but I can't find it written down in 
> anything I can readily find...
> 
> I'm trying to decode a packet that has TLVs at the end of it. One of 
> the possible TLVs is a "NULL" TLV, which is simply one or more bytes 
> with the zero value. However, if it's any other kind of TLV, it is 
> likely to start with a zero and then be followed by another value that 
> indicates the actual type.
> 
> How do I check for that second byte without reading past the end of 
> the packet buffer?

How does the code that receives one of these packets check for it?

("It is likely" makes it sound as if this would be a heuristic.  The actual
recipient of one of these packets doesn't have to use a heuristic, does it?)
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev