On Sat, Apr 20, 2002 at 06:35:07AM +0930, Richard Sharpe wrote: > When trying to analyse a trace recently, I wanted to mark no-data ACKs > differently so I could ignore them or see the patters, and I found myself > doing something like ip.len==40, which is not nice. > > So, does anyone have any objections,
I don't - it sounds reasonable and useful. > or suggestions about what the field should be? It should be the TCP payload length in the segment; I'd call it "tcp.len".
