This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

[closed] Heuristic Dissector leaves “data” on protocol tree

0

I have a dissector which seems to work perfectly. If I register to the TCP ports specifically, it is clean, but if I instead use it as heuristic TCP, it will run, but then below the dissector's tree entry there is a "data" entry with the TCP payload, even though the dissector should have consumed the entire payload. Is there a way to block this behavior so that the dissector's tree data will not be followed by the extra entry? Thanks in advance!

asked 22 Feb '12, 04:56

Clifford%20Haas's gravatar image

Clifford Haas
0222
accept rate: 0%

closed 23 Feb '12, 07:28

multipleinterfaces's gravatar image

multipleinte...
1.3k152340

What was wrong with the answer Jaap gave to your near identical question from yesterday?

(22 Feb '12, 04:59) grahamb ♦

The question has been closed for the following reason “Duplicate Question” by multipleinterfaces 23 Feb ‘12, 07:28