Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Check for end of packet?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 10 May 2007 09:46:44 -0700
Kevin A. Noll wrote:

Well, you're right on the last point. The NULL TLVs appear at the end of the
packet as padding.

So is that determined to be padding based on the length field in the packet? I.e., are they past the length specified by the length value in the header?

However, if you read the patent closely (for version 0xC1), you'll note that
the NULL TLV has no type or length value.

Where in the patent does it talk about a null TLV? It's not in the full text version, unless it talks about null TLVs without using the string "nul", or the conversion to text had an error, as I couldn't find "nul" anywhere on the full text page. For some unknown reason, Safari does an *amazingly* crappy job of showing the TIFF images (the subwindow it provides is almost exactly half the width it needs to be), so if it's described in one of the drawings, I'd prefer not to have to search for it by looking at each drawing.