Guy,
You're asking me a question I don't think I know how to answer (darned amateurs :-). The dissector in question is packet-wlccp.c. Regarding heuristic or not, I still don't fully understand what the difference is. I don't think this one is heuristic, and this should be the top layer protocol, so I wouldn't need to hand it off to another recipient. --kan-- -- Kevin A. Noll, KD4WOZ CCIE, CCDP Versatile, Inc. [EMAIL PROTECTED] +1-717-796-1936 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Guy Harris Sent: Wednesday, May 09, 2007 3:06 PM To: Developer support list for Wireshark Subject: Re: [Wireshark-dev] Check for end of packet? Kevin A. Noll wrote: > > I know this should be easy to do, but I can't find it written down in > anything I can readily find... > > I'm trying to decode a packet that has TLVs at the end of it. One of > the possible TLVs is a "NULL" TLV, which is simply one or more bytes > with the zero value. However, if it's any other kind of TLV, it is > likely to start with a zero and then be followed by another value that > indicates the actual type. > > How do I check for that second byte without reading past the end of > the packet buffer? How does the code that receives one of these packets check for it? ("It is likely" makes it sound as if this would be a heuristic. The actual recipient of one of these packets doesn't have to use a heuristic, does it?) _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
