On Fri, 19 Apr 2002, Scott Renfro wrote: > On Sat, Apr 20, 2002 at 06:35:07AM +0930, Richard Sharpe wrote: > > > > When trying to analyse a trace recently, I wanted to mark no-data ACKs > > differently so I could ignore them or see the patters, and I found > > myself doing something like ip.len==40, which is not nice. > > hmm; tcp (subject line) or ip (body)? I always do tcp.flags.push==1 to > only show packets with data. I agree that there isn't an easy way to > grab ip packets with tcp or udp data.
Well, I want to be able to mark TCP segments that have no data. Another reason for wanting the tcp.datalen header field is that the actual size of a no-data packet depends on options. Under Linux 2.4.x it is 52 bytes. Regards ----- Richard Sharpe, [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED]
