I have made a small patch to packet-data.c to differentiate between the
unknown undissected data and the PADDED bytes.
PADDED bytes are used to round the small ethernet packets to minimum
ethernet transmit unit ( 64 bytes including FCS, or 60 usable bytes).
It is important to see the padded area because in this way you could
troubleshoot more easily the dissectors (among other things).
This implies that every dissector should make a call in the end to
dissect_data(...) routine.
In this way you can see if there is more data undissected and you should
check the dissector, or there are only PADDing bytes and everything is
ok.
I got very confused when I first saw a STP packet and I realized that it
was not dissected completely.
In fact it was dissected completely, but there was left some padding
bytes.
This is the case of many other small PDU protocols like ARP, RARP and
s.o.
It is useful for learning too. :)
I don't know if the patch included in the email is the best approach of
the problem, I guess not, but it shows the idea.
Maybe if someone has a better idea ...
As I said before, in the mail is a patch to packet-data.c for
ethereal-0.8.4.
I am waiting for your opinion(s).
Paul Ionescu
diff -u -r ethereal-0.8.4.orig/packet-data.c ethereal-0.8.4.diff/packet-data.c
--- ethereal-0.8.4.orig/packet-data.c Mon Jan 24 05:33:35 2000
+++ ethereal-0.8.4.diff/packet-data.c Wed Mar 15 09:54:37 2000
@@ -43,11 +43,18 @@
void
dissect_data(const u_char *pd, int offset, frame_data *fd, proto_tree *tree)
{
+int padding;
if (IS_DATA_IN_FRAME(offset) && tree) {
proto_tree_add_item_format(tree, proto_data, offset,
END_OF_FRAME, NULL, "Data (%d byte%s)", END_OF_FRAME,
plurality(END_OF_FRAME, "", "s"));
+ offset=pi.captured_len;
}
+ padding=fd->cap_len - pi.captured_len;
+ if (padding)
+ proto_tree_add_text(tree,offset,padding,
+ "PADDing to the minimum size of ethernet packet (added %d byte%s)",
+ padding,plurality(padding,"","s"));
}
void
