Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: [Ethereal-users] ISIS support broken?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Domiciano alonso <domiciano.alonso@xxxxxxxxx>
Date: Mon, 28 Mar 2005 16:13:15 +0200
Hello,
I've seen the ISIS/OSI dissector does not work at least since 10.6;
ethereal claims the packet has an "Unknown ISO protocol":

No.     Time        Source                Destination           Protocol Info
     58 19.737276   N/A                   N/A                   ISO   
  Unknown ISO protocol (21)

Frame 58 (313 bytes on wire, 313 bytes captured)
Cisco HDLC
    Address: Multicast (0x8f)
    Protocol: OSI (0xfefe)
    CLNS Padding: 0x83
Data (308 bytes)

0000  8f 00 fe fe 83 21 01 00 19 01 00 00 01 35 d5 00   .....!.......5..
0010  b8 d7 00 00 00 00 00 00 00 00 00 00 00 ff ff ff   ................
0020  ff ff ff ff ff 09 f0 a4 70 0a 00 00 05 00 00 00   ........p.......
0030  00 00 00 57 f2 41 91 ca 69 d5 00 b8 04 00 00 00   ...W.A..i.......
0040  00 00 00 00 69 6e 1a 7b b2 d5 00 b8 07 00 00 00   ....in.{........
0050  00 00 00 0e 23 1e c4 5a c4 d5 00 b8 08 00 00 00   ....#..Z........
0060  00 00 00 01 72 3b cd 6f b4 d5 00 b8 10 00 00 00   ....r;.o........
0070  00 00 00 03 75 ef be 68 e2 d5 00 b8 10 00 00 01   ....u..h........
0080  00 00 00 04 47 9c ec e7 ee d5 00 b8 11 00 00 00   ....G...........
0090  00 00 00 17 94 ac b6 a5 70 d5 00 b8 2e 00 00 00   ........p.......
00a0  00 00 00 13 43 e8 d2 ca 43 d5 00 b8 2f 00 00 00   ....C...C.../...
00b0  00 00 00 06 15 e7 d8 ca 30 d5 00 b8 30 00 00 00   ........0...0...
00c0  00 00 00 5e df f1 fd a5 a2 d5 00 b8 33 00 00 00   ...^........3...
00d0  00 00 00 23 69 8f 21 ca f8 d5 00 b8 34 00 00 00   ...#i.!.....4...
00e0  00 00 00 24 00 fc 83 ca 68 d5 00 b8 64 00 00 00   ...$....h...d...
00f0  00 00 00 60 5e f8 54 a4 78 d5 00 b8 6e 00 00 00   ...`^.T.x...n...
0100  00 00 00 c1 60 29 3e a4 77 d5 00 b8 d7 00 00 00   ....`)>.w.......
0110  00 00 00 1f da 82 6c 09 20 80 f5 d5 00 b8 e1 00   ......l. .......
0120  00 00 00 00 00 08 8b 9a e8 d8 86 d5 00 b8 f7 00   ................
0130  00 00 00 00 00 07 b3 cf 49                        ........I

But 0x83 is the common protocol-id for ISIS in OSI; the decoding should be:

Frame 58 (313 bytes on wire, 313 bytes captured)
Cisco HDLC
    Address: Multicast (0x8f)
    Protocol: OSI (0xfefe)
    Intra Domain Routing Protocol Discriminator: ISIS (0x83)
    PDU Header Length  : 33
    Version (==1)      : 1
    System ID Length   : 0
    PDU Type           : L2 CSNP (R:000)
    Version2 (==1)     : 1
    Reserved (==0)     : 0
    Max.AREAs: (0==3)  : 0
...etc

I've upgraded to 10.10 without success

Does anybody knows if there's a bug or any?

Thank you