Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 3049] Inconsistency in dissecting IP

Date: Wed, 12 Nov 2008 02:49:07 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3049





--- Comment #4 from alu_hyd <ch_nbc@xxxxxxxxxxx>  2008-11-12 02:49:01 PDT ---
(In reply to comment #2)

Thanks a lot!
messages other than IP are our proprietary messages. 
we recently shifted to 1.0.3.. 
I tested with our wrapper over 1.0.3 and it worked.

> When I read that capture file with a fairly recent recent top-of-SVN-tree
> Wireshark, the first two packets are not shown as IP fragments because they're
> not IP fragments - the "More fragments" flag is not set and the fragment offset
> is 0.  The third packet is shown as an IP fragment because it *is* an IP
> fragment - the "More fragments" flag is set.  The fourth packet is the second
> fragment of that fragmented IP datagram - the "More fragments" flag is not set,
> and the fragment offset is 1480, which is the length of the IP payload (not the
> full IP packet) of the third packet.
> 
> So, at least for those packets, all of them are being correctly identified.
> 
> Now, some packets at the end are identified as "PPP Fragment", but that has
> nothing whatsoever to do with IP fragments.  Note that we do *NOT* fully handle
> the CDMA2000 A10 unstructured byte stream data type; we do not, for example,
> reassemble PPP frames split across multiple lower-level packets.
> 


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.