gelf-payload-decode tcpdump-x parser bad?

[Walter Doekes]

Does this read the end of packets correctly? Or should that be {2,39}?

https://github.com/ossobv/vcutil/blob/main/gelf-payload-decode#L153-L164

[Walter Doekes]

It's fine. A trailing log might look like:

	0x0030:  9894 491e                                ..I.
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

In that case we still match 39 chars.

Only for -x dumps (only hex) -- instead of -X (hex+ascii) -- would this be an issue. But nobody uses those.