Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 7488] New: Unable to correctly identify IEC 61850 MMS pack

Date: Mon, 16 Jul 2012 18:19:55 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7488

           Summary: Unable to correctly identify IEC 61850 MMS packets
           Product: Wireshark
           Version: 1.9.x (Experimental)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: Low
         Component: Dissection engine (libwireshark)
        AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
        ReportedBy: ayunus@xxxxxxxxxxxxx


Created attachment 8785
  --> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=8785
IEC 61850 MMS capture file

Build Information:
wireshark 1.9.0 (SVN Rev 43755 from /trunk)

Copyright 1998-2012 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (32-bit) with GTK+ 2.24.10, with Cairo 1.10.2, with Pango 1.30.0, with
GLib 2.32.3, with libpcap, with libz 1.2.3.4, without POSIX capabilities,
without libnl, without SMI, without c-ares, without ADNS, without Lua, without
Python, without GnuTLS, without Gcrypt, without Kerberos, without GeoIP,
without
PortAudio, with AirPcap.

Running on Linux 3.2.0-26-generic-pae, with locale en_US.UTF-8, with libpcap
version 1.1.1, with libz 1.2.3.4, without AirPcap.

Built using gcc 4.6.3.

--
Wireshark doesn't correctly identify the MMS packets (See attached capture).
The problem seems to be with the dissector incorrectly flagging the association
messages as malformed. 
In the attached capture, Association Control request in frame 7 and response in
frame 8 is flagged.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.