This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

hi, i have a custom dissector, after dissect this custom protocol, the remaining of the packet should be dissect as an ip packet. but the length of ip packet report in my custom dissector and ip length field set to zero in data.

ip packets are like this : 0x45000000....

0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length:0

i want to read Total Length from my custom protocol not the 2-3th bytes of data.can any one help me?thanks

asked 31 Aug, 12:31

ghader's gravatar image

ghader
61111620
accept rate: 0%

edited 31 Aug, 12:32


but the length of ip packet report in my custom dissector and ip length field set to zero in data.

Then it's not a valid IP packet. Fix your custom protocol, or its implementation, to provide a valid length field in the IP header.

permanent link

answered 31 Aug, 14:35

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335195
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×178
×1

question asked: 31 Aug, 12:31

question was seen: 367 times

last updated: 31 Aug, 14:35

p​o​w​e​r​e​d by O​S​Q​A