Craig Bumpstead wrote:
Hi,
I've noticed that Frame 2 with the bad header checksum reaches my dissector
but Frame 3 with a LEN=0 doesn't actually reach my dissector (Stepping
though the code with VS 2008). Is this normal for WireShark??
Note: I have censored the IP's and MAC addresses.
If there's no TCP payload (eg: the packet is just a TCP ack)
then there's nothing to dissect beyond TCP.
Frame 2 has 6 bytes of TCP payload so your dissector is called.
Frame 3 has 0 bytes of TCP payload.
Is that the question ?
