https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5645
Summary: Ethernet packets with both VLAN tag and LLC header no
longer displayed correctly
Product: Wireshark
Version: 1.5.x (Experimental)
Platform: All
OS/Version: All
Status: NEW
Severity: Minor
Priority: Low
Component: Wireshark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: bej@xxxxxxxxx
Created an attachment (id=5853)
--> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5853)
Ethernet 802.3 packets with tag headers
Build Information:
Version 1.5.0 (SVN Rev 35637 from /trunk)
Copyright 1998-2011 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (32-bit) with GTK+ 2.16.6, with GLib 2.24.2, with WinPcap (version
unknown), with libz 1.2.3, without POSIX capabilities, without libpcre, with
SMI
0.4.8, with c-ares 1.7.1, with Lua 5.1, without Python, with GnuTLS 2.8.5, with
Gcrypt 1.4.5, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built
Jan
24 2011), with AirPcap.
Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1.2
(packet.dll version 4.1.0.2001), based on libpcap version 1.0 branch 1_0_rel0b
(20091008), GnuTLS 2.8.5, Gcrypt 1.4.5, without AirPcap.
Built using Microsoft Visual C++ 9.0 build 30729
Wireshark is Open Source Software released under the GNU General Public
License.
Check the man page and http://www.wireshark.org for more information.
--
Captured packets containing both a VLAN (802.1Q) tag header and LLC/SNAP
headers are not formatted correctly with 1.5.0. The Ethernet II dissector is
used and displays the VLAN tag header but then formats the length field as an
unknown type and the remainder of the frame as raw data. For example, here's an
ARP packet:
Frame 1: 64 bytes on wire (512 bits), 64 bytes captured (512 bits)
Ethernet II (VLAN tagged), Src: Ibm_65:96:ac (00:09:6b:65:96:ac), Dst:
Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Source: Ibm_65:96:ac (00:09:6b:65:96:ac)
VLAN tag: VLAN=2, Priority=Best Effort (default)
Type: Unknown (0x0024)
Data (46 bytes)
0000 aa aa 03 00 00 00 08 06 00 06 08 00 06 04 00 01 ................
0010 00 09 6b 65 96 ac c0 a8 1f de 00 00 00 00 00 00 ..ke............
0020 c0 a8 1f 21 00 00 00 00 00 00 00 00 00 00 ...!..........
I'm attaching a packet capture file (tagged.pcap) that shows this. With
Wireshark 1.4.3, the packets in the same capture file are displayed OK.
I did see in the announce for 1.5.0 that the VLAN tag is now displayed by the
Ethernet II dissector, so maybe the same is still a work-in-progress for the
IEEE 802.3 dissector? Otherwise, I just wanted to make someone aware of this
just in case...
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
