Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Check for end of packet?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 09 May 2007 12:05:54 -0700
Kevin A. Noll wrote:

I know this should be easy to do, but I can't find it written down in
anything I can readily find...

I'm trying to decode a packet that has TLVs at the end of it. One of the
possible TLVs is a "NULL" TLV, which is simply one or more bytes with the
zero value. However, if it's any other kind of TLV, it is likely to start
with a zero and then be followed by another value that indicates the actual
type.

How do I check for that second byte without reading past the end of the
packet buffer?

How does the code that receives one of these packets check for it?

("It is likely" makes it sound as if this would be a heuristic. The actual recipient of one of these packets doesn't have to use a heuristic, does it?)