Wireshark · Ethereal-dev: Re: [Ethereal-dev] RFC: new TVBUFF type

[Guy Harris <gharris@xxxxxxxxx>]

On Wed, May 23, 2001 at 09:35:01AM +0200, andreas.sikkema@xxxxxxxxxxx wrote:
> I think all ASN.1 based protocols will be almost impossible to 
> dissect if there are holes. 

Are they impossible to dissect *at all* if the capture was done with a
short snapshot length?  Are they impossible to dissect if the
higher-level packet is not reassembled, so you only look at one frame's
worth of data?

They can't be dissected in their entirety, as there's missing data - but
you can at least start at the beginning and keep dissecting until you
run out of data (as demonstrated by the fact that we're doing exactly
that right now, for short frames and un-reassembled data).

The only difference a hole in the middle of the packet would make would
be that we'd probably stop at a point that has data somewhere after it -
just not *immediately* after it.