https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5952
Colin O'Flynn <coflynn@xxxxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #6388|review_for_checkin? |
Flag| |
Attachment #6388|0 |1
is obsolete| |
Attachment #6389| |review_for_checkin?
Flag| |
--- Comment #2 from Colin O'Flynn <coflynn@xxxxxxxxx> 2011-05-25 03:53:41 PDT ---
Created an attachment (id=6389)
--> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=6389)
Patch against SVN 37390
This patch uses the tvb_reported_length() API instead of tvb_length().
The wpan.frame_length field is required because data gets into Wireshark
through a variety of ways. The 802.15.4 MAC header itself doesn't have a length
field, that is at the PHY level, which is often not passed to wireshark.
For example if you use the ZEP protocol (Zigbee Encapsulation Layer), you would
need to filter on zep.length. If you use raw capture hardware (e.g.: ethernet
emulation) you don't have this. Frame.len seems to be the wrong size, as it
includes everything below the 802.15.4 frame:
$tshark -T fields -e wpan.frame_length -e frame.len -r ethtest.pcap
51 65
51 65
51 65
51 65
51 65
45 59
116 130
62 76
$tshark -T fields -e wpan.frame_length -e zep.length -e frame.len -r
zeptest.pcap
100 100 174
5 5 79
34 34 108
5 5 79
34 34 108
5 5 79
101 101 175
101 101 203
5 5 79
125 125 199
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
