Wireshark-users: Re: [Wireshark-users] Malformed Packet
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 11 Jan 2013 11:11:58 -0800
On Jan 11, 2013, at 5:17 AM, "Ewgenij Sokolovski" <ewgenijkkg@xxxxxx> wrote:

> Maybe it would be a good idea to change the error output? "Malformed Packet" is too general and misleading sometimes.

"Malformed packet" is used in some other cases as well.  Either we should stop putting "Malformed packet" into the protocol tree at all, and put the real error as the main message rather than the secondary message, or we should, at least, improve the secondary message(s).  In this particular case, perhaps "packet is too short" is better than the geeky "exception occurred".

> For example, not the packet could be malformed but the dissector could be buggy :)

That could be the case for *any* case where the packet dissection claims there's something wrong with the packet.