Ethereal-dev: Re: [Ethereal-dev] Having an invisible field on the TCP header giving number of
On Sat, Apr 20, 2002 at 02:20:19AM -0700, Guy Harris wrote:
> On Fri, 19 Apr 2002, Scott Renfro wrote:
> > hmm; tcp (subject line) or ip (body)? I always do tcp.flags.push==1 to
> > only show packets with data.
>
> There's no guarantee that a TCP segment with data necessarily has PSH
> set. That may be the way a lot of TCP implementations work, but I think
> I have seen TCP segments with data but with PSH not set.
Agree. I was relating a simple heuristic via private e-mail so as to
not detract from the discussion about adding the field.
> In addition, somebody might want the length - see, for example, the
> statistics that Phil Williams wanted to gather; yes, he can compute the
> TCP payload length from the IP total length, IP header length, and TCP
> header length, but if we're going to have a field to specify whether a
> TCP segment has any payload, we might as well have it specify how much
> payload it has.
Agree as well. The tcp and udp dissectors know this (more or less) when
they call tvb_new_subset(); including it as an explicit field makes
sense.
--Scott
--
Scott Renfro <scott@xxxxxxxxxx>
