Wireshark · Ethereal-dev: Re: [Ethereal-dev] tvb_reported_length_remaining

[Guy Harris <gharris@xxxxxxxxx>]

fabio matturro wrote:

> what's the difference between tvb_reported_length_remaining and 
> tvb_length_remaining?

tvbuffs have two length values, one of which is the amount of data in 
that part of the packet as it appeared on the wire (the "reported 
length") and one of which is the amount of captured data in that part of 
the packet (the length).

As noted, a capture can be "sliced" or have a "snapshot length" (same 
concept, different terminology), so that no more than the first N bytes 
of the packet are saved in the capture file; that's why the two would be 
different.

In almost all cases, one should use the reported length; if you have, 
for example, a packet with an 8-byte header followed by the payload, 
"tvb_reported_length_remaining(tvb, 8)" would indicate how much data was 
in the packet as it was received, and "tvb_length_remaining(tvb, 8)" 
would indicate how much of that data, if any, was saved as part of the 
capture.  If the packet were dissected as 4 bytes of time stamp, 4 bytes 
of sequence number, and the payload just shown as "Payload: N bytes", 
the right value of "N" would come from 
"tvb_reported_length_remaining()", not "tvb_length_remaining()".

Similarly, if the payload in that example is a sequence of 4-byte 
integers, the loop should run until it runs out of *reported* data - 
even though that means that it'll throw an exception when it runs out of 
captured data.  That's a feature - the exception means that the 
dissection will have a "captured data was cut short" indication at the end.