Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] tvb_reported_length vs tvb_captured_length

From: Bruno Verstuyft <bruno.verstuyft@xxxxxxxxxxxx>
Date: Tue, 4 Jun 2019 09:51:39 +0000
Hi,

I have a question regarding the difference between tvb_reported_length and tvb_captured_length.
According to the discussion in
, the reported length should be used in most cases. Captured length should only be used in some specific use cases.

However, in the developer documentation "Adding a basic dissector" (https://www.wireshark.org/docs/wsdg_html_chunked/ChDissectAdd.html), the dissect_foo function returns tvb_captured_length.

It also looks like "return tvb_captured_length" is used more in the code than "return tvb_reported_length".

Bruno Verstuyft
Senior Testing and Software Engineer
Excentis
Gildestraat 8
9000 Gent  -  Belgium
Tel: +32 9 269 22 91