Wireshark · Wireshark-dev: Re: [Wireshark-dev] How to remove the {Malformed Packet] warning message

[Guy Harris <guy@xxxxxxxxxxxx>]

On Dec 10, 2008, at 6:28 AM, spiritsince1969@xxxxxxxxx wrote:

>   Thanks for your advice. but all I want is to get rid of red  
> [Malformed Packet : myprotocolname] label, when my packet is  
> undersize or oversize. Do you have any suggestions?

Yes.

Our suggestion is that you don't read more bytes from the tvb than are  
in the packet itself.

If you are getting a "Malformed Packet" error, either

	1) your packet is malformed, in that the dissector expects there to  
be certain data in the packet but it's *not* in the packet

or

	2) your dissector has a bug, in that it's expecting certain data to  
be in the packet that isn't there and isn't supposed to be there.

We would have to see

	1) the source code to your dissector

and

	2) a specification for the protocol

and

	3) an example of a packet with this problem

in order for us to determine whether 1) or 2) is the problem and what  
the details of the packet problem or dissector bug is.