Wireshark · Wireshark-users: Re: [Wireshark-users] Malformed Packet

[Martin Mathieson <martin.r.mathieson@xxxxxxxxxxxxxx>]

On Fri, Jan 11, 2013 at 7:11 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:

On Jan 11, 2013, at 5:17 AM, "Ewgenij Sokolovski" <ewgenijkkg@xxxxxx> wrote:

> Maybe it would be a good idea to change the error output? "Malformed Packet" is too general and misleading sometimes.

"Malformed packet" is used in some other cases as well.  Either we should stop putting "Malformed packet" into the protocol tree at all, and put the real error as the main message rather than the secondary message, or we should, at least, improve the secondary message(s).  In this particular case, perhaps "packet is too short" is better than the geeky "exception occurred".

> For example, not the packet could be malformed but the dissector could be buggy :)

That could be the case for *any* case where the packet dissection claims there's something wrong with the packet.

I like having malformed in the protocol tree, or at least I like to be able to use the 'malformed' filter.

Note that it is also added hidden when malformed is used as a type of expert info.

Martin