Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 1570] "decoded as" cannot be reverted

Date: Sat, 9 Aug 2008 01:41:28 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1570


Sake <sake@xxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |WONTFIX




--- Comment #4 from Sake <sake@xxxxxxxxxx>  2008-08-09 01:41:26 PDT ---
This is not a generic problem, but a special case for which there is a
workaround. 

First of all, the workaround is to open "Analyze" -> "User Specified Decodes"
and click on "Clear"

The problem in this case is that once "Ethernet" has been selected as the link
type for "Ethertype 0x8864", the packet will be dissected as an Ethernet frame
on top of an Ethernet frame. As this data was not an Ethernet frame, but other
data, it unfortunately happens to have the bytes "0x0000" at the place where
the ethertype is expected.

This "Ethertype = 0x0000" causes the function "decode_as_OK()" to return a
false which makes the "Decode As" grey out.

As this problem only occurs when you decode some date as something that it not
really is (and which can be reverted by the workaround), I'm closing this bug
as wontfix.


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.