Wireshark · Wireshark-dev: Re: [Wireshark-dev] tvb_captured_length or tvb_reported_length?

[Pascal Quantin <pascal.quantin@xxxxxxxxx>]

2015-09-02 19:37 GMT+02:00 Evan Huus <eapache@xxxxxxxxx>:

Many systems support packet capture such that only the first n bytes
of each captured packet is saved, as this is far more efficient and
frequently enough if you're only interested in the headers. When that
occurs, "captured" is the number of bytes actually captured, while
"reported" is the original number of bytes on the wire.

The vast majority of the time, dissectors need to use the length
reported on the wire; the captured length is only useful in specific
circumstances like reassembling fragmented messages.

Evan

Evan was faster than me ;) Interestingly we did not think to the same use case for captured length usage, which shows why I said it deserves careful thinking.

Pascal.
 

On Wed, Sep 2, 2015 at 1:33 PM, Robert Cragie
<robert.cragie@xxxxxxxxxxxxx> wrote:
> I am trying to understand the changes to the previous use of tvb_length().
> There are now two functions (and their associates):
>
> * tvb_captured_length()
> * tvb_reported_length()
>
> As far as I can tell, tvb_captured_length() is the direct replacement for
> tvb_length() but tvbuff.h says "You probably want tvb_reported_length
> instead.". The use of both seems to be mixed throughout the files and it's
> difficult to follow the relationship between the two. So any guidance on
> this would be appreciated.
>
> Thanks
>
> Robert
>

> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
> Archives:    https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe