Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Hierarchy of fields & offsets again, more potential offender

From: Stig Bjørlykke <stig@xxxxxxxxxxxxx>
Date: Thu, 10 Aug 2017 10:55:18 +0200
On Wed, Aug 9, 2017 at 7:05 PM, Pascal Quantin <pascal.quantin@xxxxxxxxx> wrote:
> What about marking it as PROTO_ITEM_SET_GENERATED() as a first step? Tis
> value is inferred from the tvb length and not a real field.

It's not a generated field (the bytes are fetched directly from the
packet without any modifications) so this would be wrong.

I suppose Sake has a use case for the tcp.payload which may lead us to
a hint for how to mark such fields?
Because we may end up with udp.payload, ssl.payload, http.payload,
sctp.payload, tftp.payload, etc. and that would mess up a bit if we
don't handle them correct.  Right?


-- 
Stig Bjørlykke