Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] How to remove the {Malformed Packet] warning message

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 12 Dec 2008 16:00:53 -0800

On Dec 10, 2008, at 6:28 AM, spiritsince1969@xxxxxxxxx wrote:

Thanks for your advice. but all I want is to get rid of red [Malformed Packet : myprotocolname] label, when my packet is undersize or oversize. Do you have any suggestions?

Yes.

Our suggestion is that you don't read more bytes from the tvb than are in the packet itself.

If you are getting a "Malformed Packet" error, either

1) your packet is malformed, in that the dissector expects there to be certain data in the packet but it's *not* in the packet

or

2) your dissector has a bug, in that it's expecting certain data to be in the packet that isn't there and isn't supposed to be there.

We would have to see

	1) the source code to your dissector

and

	2) a specification for the protocol

and

	3) an example of a packet with this problem

in order for us to determine whether 1) or 2) is the problem and what the details of the packet problem or dissector bug is.