Wireshark-dev: Re: [Wireshark-dev] False positive from the new "Look for incomplete dissectors"
From: Jeff Morriss <[email protected]>
Date: Fri, 13 Feb 2015 11:15:04 -0500
On 02/13/15 04:14, Anders Broman wrote:
Den 13 feb 2015 09:45 skrev "Dario Lombardo"
<[email protected] <mailto:[email protected]>>:
 >
 >
 >
 > On Thu, Feb 12, 2015 at 6:18 PM, Anders Broman <[email protected]
<mailto:[email protected]>> wrote:
 >>
 >> I suspected as much, but I think all the sip lines skip the CRLF...
 >>
 >>
 > What about adding the skipped bytes as hidden, labeled as "unused
bytes"?
 >
 >
First thought is, unnecessary processing to satisfy this new
functionality, which frankly I have my doubts about...
I have to admit that I like being able to click on a byte and see what 
field it maps to.  From that perspective I like when padding is claimed 
by the dissector which knew it was padding.  And when CR+NL are claimed 
by the item which they terminate.
If this functionality encourages dissectors to claim all the bytes used 
by their protocol that is, in my opinion, a good thing.