Wireshark · Ethereal-dev: Re: [Ethereal-dev] Handling of TVBs

[Guy Harris <gharris@xxxxxxxxx>]

On Fri, Dec 27, 2002 at 05:01:42PM +0100, Michael Tuexen wrote:
> But should not the case reported length <> length also raise an 
> exception?

No, it should not necessarily do so.  That will often be the case, for
example, if you have captured with a snapshot length less than the
maximum packet length, as the reported length will be the length of the
packet as delivered to the machine running Ethereal and the length will
be the length of the packet after trimming the packet to the snapshot
length.

If by "<>" you meant "<", then, at least in the case of packets from the
link layer, that "should not happen", and probably means a corrupt
capture file or a bug in the capture mechanism or libpcap.  The correct
fix for that might just be to have Wiretap reduce the length so that
it's <= the reported length.