Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 3112] CDP Checksum Calculation Incorrect

Date: Mon, 5 Jan 2009 11:14:55 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3112





--- Comment #21 from Sake <sake@xxxxxxxxxx>  2009-01-05 11:14:50 PDT ---
If I run "Captured packets from a 2950 switch" against my Cisco 2950 (running
12.1(22)EA9), all packets are accepted and I see 5 new neighbors:

c2950#sh cdp nei
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
aa.foxpaws.net   Fas 0/22           178          S I      WS-C2950T-Fas 0/1
switchfox.foxpaws.net
                 Fas 0/22           176          S I      WS-C2950T-Fas 0/1
a.foxpaws.net    Fas 0/22           177          S I      WS-C2950T-Fas 0/1
abc.foxpaws.net  Fas 0/22           179          S I      WS-C2950T-Fas 0/1
c2950#

When I change the checksum of the CDP packet for a.foxpaws.net to a bogus value
and the checksum of the CDP packet for aa.foxpaws.net to 0x9ad1 (as wireshark
currently thinks it should be) I only see 3:

c2950#sh cdp nei
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
abcd.foxpaws.net Fas 0/22           177          S I      WS-C2950T-Fas 0/1
switchfox.foxpaws.net
                 Fas 0/22           178          S I      WS-C2950T-Fas 0/1
abc.foxpaws.net  Fas 0/22           176          S I      WS-C2950T-Fas 0/1
c2950#

Which means that a) the checksums are indeed checked and b) that my ios
software thinks all the original checksums are indeed correct and the wireshark
checksum is not correct.

Hope this helps...


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.