Re: catching [Malformed Packet]

[Guy Harris <guy () alum mit edu>]

On Sep 24, 2011, at 9:58 AM, Chris Maynard wrote:

> Roland Knall <rknall@...> writes:
>
> > On a similar topic, how can you mark a package as malformed?
> > Especially generated packages often fail the openSAFETY dissector, and
> > marking them as malformed seems to make sense in such cases.
>
> Many dissectors make use of the expert infos for this.

...which is the right way to do it.  Doing it by throwing an exception makes errors such as "malformed because field 
XXX is too short" indistinguishable from "malformed because the packet is missing data at the end", and also means you 
stop dissecting at that point.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe