Wireshark mailing list archives
Re: tvb_captured_length or tvb_reported_length?
From: Pascal Quantin <pascal.quantin () gmail com>
Date: Wed, 2 Sep 2015 19:46:43 +0200
2015-09-02 19:37 GMT+02:00 Evan Huus <eapache () gmail com>:
Many systems support packet capture such that only the first n bytes of each captured packet is saved, as this is far more efficient and frequently enough if you're only interested in the headers. When that occurs, "captured" is the number of bytes actually captured, while "reported" is the original number of bytes on the wire. The vast majority of the time, dissectors need to use the length reported on the wire; the captured length is only useful in specific circumstances like reassembling fragmented messages. Evan
Evan was faster than me ;) Interestingly we did not think to the same use case for captured length usage, which shows why I said it deserves careful thinking. Pascal.
On Wed, Sep 2, 2015 at 1:33 PM, Robert Cragie <robert.cragie () gridmerge com> wrote:I am trying to understand the changes to the previous use oftvb_length().There are now two functions (and their associates): * tvb_captured_length() * tvb_reported_length() As far as I can tell, tvb_captured_length() is the direct replacement for tvb_length() but tvbuff.h says "You probably want tvb_reported_length instead.". The use of both seems to be mixed throughout the files andit'sdifficult to follow the relationship between the two. So any guidance on this would be appreciated. Thanks Robert___________________________________________________________________________Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org ?subject=unsubscribe
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- tvb_captured_length or tvb_reported_length? Robert Cragie (Sep 02)
- Re: tvb_captured_length or tvb_reported_length? Evan Huus (Sep 02)
- Re: tvb_captured_length or tvb_reported_length? Pascal Quantin (Sep 02)
- Re: tvb_captured_length or tvb_reported_length? Pascal Quantin (Sep 02)
- Re: tvb_captured_length or tvb_reported_length? Guy Harris (Sep 02)
- Re: tvb_captured_length or tvb_reported_length? Robert Cragie (Sep 03)
- Re: tvb_captured_length or tvb_reported_length? Guy Harris (Sep 03)
- Re: tvb_captured_length or tvb_reported_length? Alexis La Goutte (Sep 03)
- Re: [Wireshark-dev] tvb_captured_length or tvb_reported_length? Christopher Maynard (Sep 03)
- Re: tvb_captured_length or tvb_reported_length? Robert Cragie (Sep 03)
- Re: tvb_captured_length or tvb_reported_length? Evan Huus (Sep 02)