Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] malformed packet

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Mon, 07 Jul 2008 11:26:22 -0400


Martin Corraine (mcorrain) wrote:
Hello,
If I check a packet's header and size and return 0 because it wasn't my protocol (GED125), should I get the following message: "Malformed Packet: GED125"?

Probably not.

Are you sure it's actually returning 0 for that packet? It sounds like your dissector generated an exception (normally because it read beyond the end of a TVB). Maybe you need to check tvb_length() before the rest of your heuristic checks?