Home page logo

wireshark logo Wireshark mailing list archives

Re: FT_BYTES hf with len==0
From: Guy Harris <guy () alum mit edu>
Date: Mon, 16 Dec 2013 12:13:39 -0800

On Dec 16, 2013, at 8:48 AM, Martin Kaiser <lists () kaiser cx> wrote:

The idea would be to allow filtering for this element although it has no
value (it's just there).

Do you mean "this is a byte array field that has a length that can range from 0 to {some maximum value}", so that the 
field might have some value in some packets, or do you mean "I just want to add a flag to a packet, carrying one bit's 
worth of information by its presence or absence"?

In the latter case, a (computed) FT_NONE or FT_BOOLEAN field would be more appropriate than an FT_BYTES field.

(Or perhaps what you really want is an expert info item.)
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]