dot dot dot at the end of the frame

asked 2021-07-19 13:05:48 +0000

Glupsch21
3 ●2 ●4 ●5

hi,

does someone know what it means when there is in the own builded tree dot dot dot after an frame even if this isnt the end of the frame? for example: deescaped_frame: 3b31333a... And the frame is: 3b31333a30b64f

thanks alot

answered 2021-07-20 07:22:10 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●973 ●227 https://www.wireshark.org

Usually the dot-dot-dot (known as an ellipsis) indicates the display is truncated and there is more actual data to follow.

What is your field type in the dissector for this data?

edit flag offensive delete link

Comments

it is bytes

Glupsch21 ( 2021-07-20 09:30:59 +0000 )edit

Since FT_BYTES items can be of arbitrary length these are indeed truncated to a certain length.

Jaap ( 2021-07-20 10:54:37 +0000 )edit

than how can i be sure that the packet is uncut?

Glupsch21 ( 2021-07-20 13:21:14 +0000 )edit

You can see the bytes in the value by selecting it in the tree and looking at the bytes highlighted in the hex pane.

If the value\packet is shorter than expected the dissector should have either detected that or there should be a malformed packet error when the dissector tried to access beyond the end of the packet.

grahamb ( 2021-07-20 13:27:24 +0000 )edit

Thanks alot!

Glupsch21 ( 2021-07-21 08:14:45 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

dot dot dot at the end of the frame

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

dot dot dot at the end of the frame edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

dot dot dot at the end of the frame