Ethereal-dev: Re: [Ethereal-dev] odd size report

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 23 Nov 2003 17:43:42 -0800
On Sun, Nov 23, 2003 at 07:12:46PM -0500, Nate Lally wrote:
> is there something that would cause a size misreport on a 32 byte icmp 
> echo request using the following code?
> 
>    hfinfo = proto_registrar_get_byname("data");
>    if (hfinfo != NULL) {
>      finfos = proto_get_finfo_ptr_array(edt->tree, hfinfo->id);
>      if (finfos && (g_ptr_array_len(finfos) != 0)) {
>        finfo = g_ptr_array_index(finfos, 0);
>        data = tvb_get_ptr(finfo->ds_tvb, finfo->start, finfo->length);
>        data_s = finfo->length;
>        fprintf(stderr, "size %d start %d\n", data_s, finfo->start);
>      } else {
>        fprintf(stderr, "no finfo for %s\n", hfinfo->abbrev);
>      }
>    }
> 
> i am working on a packet generation framework and i am trying to place the 
> contents of icmp data into a buffer
> yet it cuts off the last 6 bytes for some reason- on a 74 byte packet- 
> tvb_length reports 68.

If 68 is the length of the top-level tvbuff for the link-layer frame,
that could just be the result of the link-layer frame being cut off at
68 bytes by, for example, tcpdump's default snapshot length of 68.

"ds_tvb" would, for a non-reassembled packet, be the top-level tvbuff.