Wireshark-dev: Re: [Wireshark-dev] [PATCH] Fix false malformed SSL handshakemessages (Was: Catc
From: Sake Blok <[email protected]>
Date: Mon, 16 Apr 2007 10:02:19 +0200
On Mon, Apr 16, 2007 at 07:48:00AM +0200, Kukosa, Tomas wrote:
> I think your solution is not workaround but quite standard solution in
> Wireshark.
> As it is not guaranteed that you have captured whole SSL session it is
> better to have good heuristic than to relay upon state information.

OK, that makes sense too! Although my personality would like to see
everything analysed with 100% certaintly, the real world is not 
always perfect, and tracesfiles might not always be either...

Let's stick to the currently committed heuristic solution, the 
chances of a false malformed packet are deminished by a large factor.