Ethereal-dev: Re: [Ethereal-dev] Having an invisible field on the TCP header giving number of

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 20 Apr 2002 02:20:19 -0700
On Fri, 19 Apr 2002, Scott Renfro wrote:
> hmm; tcp (subject line) or ip (body)?  I always do tcp.flags.push==1 to
> only show packets with data.

There's no guarantee that a TCP segment with data necessarily has PSH
set.  That may be the way a lot of TCP implementations work, but I think
I have seen TCP segments with data but with PSH not set.

In addition, somebody might want the length - see, for example, the
statistics that Phil Williams wanted to gather; yes, he can compute the
TCP payload length from the IP total length, IP header length, and TCP
header length, but if we're going to have a field to specify whether a
TCP segment has any payload, we might as well have it specify how much
payload it has.

> I agree that there isn't an easy way to grab ip packets with tcp or
> udp data.

Yes, it might be useful to have a "udp.len" field as well.