Wireshark-users: Re: [Wireshark-users] Display filter for TCP reserved field
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Wed, 29 Sep 2010 17:42:38 -0600
On Wed, Sep 29, 2010 at 10:41:53PM +0100, Marco S. Zuppone wrote:

> have you, in your professional experience, ever found a traffic where 
> the reserved field was not 0000 ??

That's a field I've never paid much attention to, so I wouldn't be able 
to say one way or another.  I've seen trailers at the end of packets 
containing random data (or not so random data, such as user data that 
the server was handling in one way or another).  The reserved field is 
specifically a "MBZ" (Must Be Zero), so it should always be zeros and 
not random data.

> I noticed that in WireShark 1.4 is possible to write a dissector with 
> LUA...is this working well? Seems a great feature to me!

I've never tried using LUA scripting, but I see it mentioned often on 
the developers mailing list.