This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a dissector which seems to work perfectly. If I register to the TCP ports specifically, it is clean, but if I instead use it as heuristic TCP, it will run, but then below the dissector's tree entry there is a "data" entry with the TCP payload, even though the dissector should have consumed the entire payload. Is there a way to block this behavior so that the dissector's tree data will not be followed by the extra entry? Thanks in advance!

asked 22 Feb '12, 04:56

Clifford%20Haas's gravatar image

Clifford Haas
0222
accept rate: 0%

closed 23 Feb '12, 07:28

multipleinterfaces's gravatar image

multipleinte...
1.3k152340

What was wrong with the answer Jaap gave to your near identical question from yesterday?

(22 Feb '12, 04:59) grahamb ♦

The question has been closed for the following reason "Duplicate Question" by multipleinterfaces 23 Feb '12, 07:28

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×10

question asked: 22 Feb '12, 04:56

question was seen: 1,731 times

last updated: 23 Feb '12, 07:28

p​o​w​e​r​e​d by O​S​Q​A