This is our old Q&A Site. Please post any new questions and answers at

I am working with pdml format. I am trying to determine the octets of a frame using the nodes of a frame in pdml (field, proto). sometimes there is a field (filter) called tcp.pdu.size which value is the octets of the payload. Why this filed is not presented always if tcp contains any upper layer protocol? for example if tcp contains http, then tcp.pdu.size not presented, but in case of diameter it is. why does not this node have a hidden attribute?

<field name="tcp.pdu.size" showname="PDU Size: 96" size="96" pos="70" show="96"   value="010000600000011800000000506af74f48c2f57d0000010c4000000c000007d10000010840000022696d7361735858582e696d7361732e6572696373736f6e2e736500000000012840000019696d7361732e6572696373736f6e2e7365000000"/>

asked 20 Aug '13, 02:34

HiB's gravatar image

accept rate: 0%

The field is populated if the protocol runing atop of TCP uses tcp_dissect_pdus() metod of doing reassembly (see readme.dissectors 2.7 and 2.7.1). The field isn't hidden as it wouldn't be visible in the GUI if it was and use of hidden fields are generaly discurraged as you would have to know about them to be able to use them.

permanent link

answered 21 Aug '13, 08:20

Anders's gravatar image

Anders ♦
accept rate: 17%

Thanks! then I need to find another way to able to determine the octets of a packet (I am struggling with padding octets)

(21 Aug '13, 08:41) HiB
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 20 Aug '13, 02:34

question was seen: 3,047 times

last updated: 21 Aug '13, 08:41

p​o​w​e​r​e​d by O​S​Q​A