[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Martin Corraine (mcorrain) wrote:
> Hello,
>  
> If I check a packet's header and size and return 0 because it wasn't my 
> protocol (GED125), should I get the following message: "Malformed 
> Packet: GED125"?

Probably not.

Are you sure it's actually returning 0 for that packet?  It sounds like 
your dissector generated an exception (normally because it read beyond 
the end of a TVB).  Maybe you need to check tvb_length() before the rest 
of your heuristic checks?