Wireshark 4.5.0
The Wireshark network protocol analyzer
|
Public Attributes | |
tvbuff_t * | next |
const struct tvb_ops * | ops |
bool | initialized |
unsigned | flags |
struct tvbuff * | ds_tvb |
const uint8_t * | real_data |
unsigned | length |
unsigned | reported_length |
unsigned | contained_length |
int | raw_offset |
unsigned tvbuff::contained_length |
If this was extracted from a parent tvbuff, this is the amount of extracted data that was reported as being in the parent tvbuff; if this represents a blob of data in that tvbuff that has a length specified by data in that tvbuff, it might be greater than the amount of data that was actually there to extract, so it could be greater than reported_length.
If this wasn't extracted from a parent tvbuff, this is the same as reported_length.
This must never be > reported_length.
struct tvbuff* tvbuff::ds_tvb |
data source top-level tvbuff
unsigned tvbuff::length |
Amount of data that's available from the capture file. This is the length of virtual buffer (and/or real_data). It may be less than the reported length if this is from a packet that was cut short by the capture process.
This must never be > reported_length or contained_length.
const uint8_t* tvbuff::real_data |
Pointer to the data for this tvbuff. It might be null, which either means that 1) it's a zero-length tvbuff or 2) the tvbuff was lazily constructed, so that we don't allocate a buffer of backing data and fill it in unless we need that data, e.g. when tvb_get_ptr() is called.
unsigned tvbuff::reported_length |
Amount of data that was reported as being in the packet or other data that this represents. As indicated above, it may be greater than the amount of data that's available.