On Sat, 20 Apr 2002, Guy Harris wrote: > On Sat, Apr 20, 2002 at 06:35:07AM +0930, Richard Sharpe wrote: > > When trying to analyse a trace recently, I wanted to mark no-data ACKs > > differently so I could ignore them or see the patters, and I found myself > > doing something like ip.len==40, which is not nice. > > > > So, does anyone have any objections, > > I don't - it sounds reasonable and useful. > > > or suggestions about what the field should be? > > It should be the TCP payload length in the segment; I'd call it > "tcp.len".
OK, added, and tested now. It works. It might not be in the most appropriate place. Regards ----- Richard Sharpe, [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED]
