Bytes accumulation in an ICMP packet

edit

It says Timestamp from icmp data: so the timestamp is part of the data but then the next line Data does not show all the data since the timestamp is carved from data.

So values for data.data and data.len depend on if a icmp.data_time was cut out of the data.

See discussion on 19283: Timestamp from icmp data is incorrect in Wireshark v4.0.7-0-g0ad1823c for more background info.

Code that makes the SWAG at a timestamp - epan/dissectors/packet-icmp.c:

        /* Interpret the first 8 or 16 bytes of the icmp data as a timestamp
         * But only if it does look like it's a timestamp.
         *
         */
        int len = get_best_guess_timestamp(tvb, 8, &pinfo->abs_ts, &ts);
        if (len) {
            proto_tree_add_time(icmp_tree, hf_icmp_data_time,
                        tvb, 8, len, &ts);
            nstime_delta(&time_relative, &pinfo->abs_ts,
                     &ts);
            ti = proto_tree_add_time(icmp_tree,
                         hf_icmp_data_time_relative,
                         tvb, 8, len,
                         &time_relative);
            proto_item_set_generated(ti);
            call_data_dissector(tvb_new_subset_remaining(tvb,
                                8 + len),
                       pinfo, icmp_tree);