https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6718
--- Comment #7 from Anders Broman <anders.broman@xxxxxxxxxxxx> 2012-03-05 01:38:55 PST ---
(In reply to comment #6)
> (In reply to comment #5)
> > Status update as of rev41328:
> >
> > Steps:
> > 1) cd ~/sandbox/wireshark-1.7.1-SVN-41328
> > 2) ./dumpcap -i p132p1 -f tcp -i lo -i p3p1 -f udp -c 1 -w rev41328.pcapng
> > 3) ./tshark -r rev41328.pcapng -w n.pcapng
> > or
> > ./editcap -T ether rev41328.pcapng n.pcapng
> >
> > Result (n.pcapng)
> >
> > * the SHB and IDB options are being copied
> > * the ISB blocks are still being dropped
> > * the IDB if_filter option is being dropped
> > * the IDB if_tsresol option is being created by tshark/editcap
> > (it is written by the wiretap API with a default value of 6;
> > but it is not written by dumpcap API)
> > * ERROR: there are strings being corrupted (namely the if_name)
> >
> > ---------
> > @@ -11,55 +11,26 @@
> > F: Snaplen = 65535
> > F: Linktype = 1
> > O: Option code 2 = 'p132p1'
> > - O: Option code 11 = 'tcp'
> > + O: Option code 9 = 6
> > O: Option code 12 = 'Linux 3.2.7-1.fc16.x86_64'
> > 000000C8 Block 0x00000001 - Interface Description Block
> > - F: Block total len = 64 (0x40) bytes
> > + F: Block total len = 72 (0x48) bytes
> > F: Snaplen = 65535
> > F: Linktype = 1
> > - O: Option code 2 = 'lo'
> > + O: Option code 2 = 'lo32p1'
> > + O: Option code 9 = 6
> > O: Option code 12 = 'Linux 3.2.7-1.fc16.x86_64'
> > -00000108 Block 0x00000001 - Interface Description Block
> > - F: Block total len = 76 (0x4c) bytes
> > +00000110 Block 0x00000001 - Interface Description Block
> > + F: Block total len = 72 (0x48) bytes
> > F: Snaplen = 65535
> > F: Linktype = 1
> > - O: Option code 2 = 'p3p1'
> > - O: Option code 11 = 'udp'
> > + O: Option code 2 = 'p3p1p1'
> > + O: Option code 9 = 6
> > O: Option code 12 = 'Linux 3.2.7-1.fc16.x86_64'
> > ...
> > ---------
> >
> > Note that the if_name in the second and third IDBs don't match the initial
> > values.
> >
> > This problem "may" be related to the to way string options are being
> > handled:
> > * dumpcap: the NUL character is written to the file and the option_len
> > reflects this
> > * wiretap: the read operation uses the option_length field to read/copy
> > the string but the write operation discards the string NUL character.
> > This makes all string option length fields values 1 byte shorter in the
> > new file (the one created with tshark or editcap).
> OOPS! The string option values in the new pcapng are not corrupted. My dump
> program is using the ntar library and it expects the strings to be NUL
> terminated.
if_filter should survive reading and writing by dumpcap/wireshark as of 41352
note that if_filter is not a string "..The first byte of the Option Data keeps
a code of the filter used..." dumpcap/wireshark treated it as a string the ntar
library might as well...
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
