Hi,
Dissect it all I say. That’s what this tool is for.
Jaap
> On 21 Jun 2022, at 18:53, Richard Sharpe <realrichardsharpe@xxxxxxxxx> wrote:
>
> Hi folks,
>
> One of the things I dislike in dissectors is where people don't
> dissect all the bytes in a packet. Sometimes it is done because the
> bytes are padding bytes or because the function of those bytes is
> unknown or what have you.
>
> An interesting case relates to radiotap where since the HE (High
> Efficiency, Wi-Fi 6) version the spec has included an set of 'known'
> fields in the header. These bits indicate which of the following
> fields are actually known. Fields that are not known will have values
> in them but the values did not come from hardware.
>
> The question is: Should those fields be displayed but marked as not
> known? That is, should they be inserted into the tree.
>
> Doing so makes filtering easier because you can just filter on the
> fields of interest instead of having to filter on a known field.
>
> Not doing so leaves gaps in the data if you are looking at the data
> portion of a frame.
>
> Any thoughts on how this should be handled?
>
> --
> Regards,
> Richard Sharpe
> (何以解憂？唯有杜康。--曹操)(传说杜康是酒的发明者)
> ___________________________________________________________________________
> Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
> Archives: https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
> mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe