Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 4716] tcp dissector doesn't decode TCP segments of length

Date: Fri, 1 Jul 2011 02:02:55 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4716

--- Comment #3 from Jaap Keuter <jaap.keuter@xxxxxxxxx> 2011-07-01 11:02:51 CEST ---
(In reply to comment #2)
> But I also noticed that if the packet was a zero window probe, the single byte
> of data wasn't being displayed in the tree.  The comments in the code indicated
> that "zwp contain too little data (1 byte) so why bother", but I disagree.  I
> think Wireshark should display it even if it's only 1 byte.

Agreed.

> The comment also indicates that TCP keepalives just contain "garbage" so don't
> display that data either.  I have left this part alone for now, but wonder if
> it might be worth displaying that too?  The 1 byte of data, if present,
> *should* be garbage, but in theory could be used to transfer actual data. 

Agreed, For a network analysis tool *nothing* is 'garbage'. It's in these
fields that new information can be found. That's why we should show reserved
and unknown data fields, padding, trailers, etc, etc.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.