Wireshark-dev: Re: [Wireshark-dev] False positive from the new "Look for incomplete dissectors"
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 13 Feb 2015 11:15:04 -0500
On 02/13/15 04:14, Anders Broman wrote:


Den 13 feb 2015 09:45 skrev "Dario Lombardo"
<dario.lombardo.ml@xxxxxxxxx <mailto:dario.lombardo.ml@xxxxxxxxx>>:
 >
 >
 >
 > On Thu, Feb 12, 2015 at 6:18 PM, Anders Broman <a.broman58@xxxxxxxxx
<mailto:a.broman58@xxxxxxxxx>> wrote:
 >>
 >> I suspected as much, but I think all the sip lines skip the CRLF...
 >>
 >>
 > What about adding the skipped bytes as hidden, labeled as "unused
bytes"?
 >
 >
First thought is, unnecessary processing to satisfy this new
functionality, which frankly I have my doubts about...
I have to admit that I like being able to click on a byte and see what field it maps to. From that perspective I like when padding is claimed by the dissector which knew it was padding. And when CR+NL are claimed by the item which they terminate.
If this functionality encourages dissectors to claim all the bytes used by their protocol that is, in my opinion, a good thing.