Ask Your Question
0

dot dot dot at the end of the frame

asked 2021-07-19 13:05:48 +0000

Glupsch21 gravatar image

hi,

does someone know what it means when there is in the own builded tree dot dot dot after an frame even if this isnt the end of the frame? for example: deescaped_frame: 3b31333a... And the frame is: 3b31333a30b64f

thanks alot

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-07-20 07:22:10 +0000

grahamb gravatar image

Usually the dot-dot-dot (known as an ellipsis) indicates the display is truncated and there is more actual data to follow.

What is your field type in the dissector for this data?

edit flag offensive delete link more

Comments

it is bytes

Glupsch21 gravatar imageGlupsch21 ( 2021-07-20 09:30:59 +0000 )edit

Since FT_BYTES items can be of arbitrary length these are indeed truncated to a certain length.

Jaap gravatar imageJaap ( 2021-07-20 10:54:37 +0000 )edit

than how can i be sure that the packet is uncut?

Glupsch21 gravatar imageGlupsch21 ( 2021-07-20 13:21:14 +0000 )edit

You can see the bytes in the value by selecting it in the tree and looking at the bytes highlighted in the hex pane.

If the value\packet is shorter than expected the dissector should have either detected that or there should be a malformed packet error when the dissector tried to access beyond the end of the packet.

grahamb gravatar imagegrahamb ( 2021-07-20 13:27:24 +0000 )edit

Thanks alot!

Glupsch21 gravatar imageGlupsch21 ( 2021-07-21 08:14:45 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-07-19 13:05:48 +0000

Seen: 541 times

Last updated: Jul 20 '21