This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

what is the purpose of tcp.pdu.size filter

0

I am working with pdml format. I am trying to determine the octets of a frame using the nodes of a frame in pdml (field, proto). sometimes there is a field (filter) called tcp.pdu.size which value is the octets of the payload. Why this filed is not presented always if tcp contains any upper layer protocol? for example if tcp contains http, then tcp.pdu.size not presented, but in case of diameter it is. why does not this node have a hidden attribute?

<field name="tcp.pdu.size" showname="PDU Size: 96" size="96" pos="70" show="96"   value="010000600000011800000000506af74f48c2f57d0000010c4000000c000007d10000010840000022696d7361735858582e696d7361732e6572696373736f6e2e736500000000012840000019696d7361732e6572696373736f6e2e7365000000"/>

asked 20 Aug '13, 02:34

HiB's gravatar image

HiB
16●3●3●7
accept rate: 0%

One Answer:

2

The field is populated if the protocol runing atop of TCP uses tcp_dissect_pdus() metod of doing reassembly (see readme.dissectors 2.7 and 2.7.1). The field isn't hidden as it wouldn't be visible in the GUI if it was and use of hidden fields are generaly discurraged as you would have to know about them to be able to use them.

answered 21 Aug '13, 08:20

Anders's gravatar image

Anders ♦
4.6k●9●52
accept rate: 17%

Thanks! then I need to find another way to able to determine the octets of a packet (I am struggling with padding octets)

(21 Aug '13, 08:41) HiB