Wireshark Generic Dissector

Rules for reading data

A field must be entirely read from, 2 exclusives choices :
- real data
- decoder and/or internal_frame


Example :

  string(7)    a_string;
  
  if ( data size in internal_frame is >= 7 )
  {
    read 7 bytes from internal_frame
  }
  else if (( data size in internal_frame is > 0 ) and ( decoder does not exist ))
  {
    FATAL ERROR
  }
  else if ( decoder exists )
  {
    ask missing data (7 - size in internal_frame) to decoder
    if ( decoder do not retrieve enough data )
    {
      FATAL ERROR
    }
    read 7 bytes from internal_frame
  }
  else
  {
    read 7 bytes from real data
  }
CSS Template by Rambling Soul