Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 7839] New: MP2T dissector is more strict in 1.8.0 and upwa

Date: Wed, 10 Oct 2012 09:24:33 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7839

           Summary: MP2T dissector is more strict in 1.8.0 and upwards
           Product: Wireshark
           Version: 1.8.3
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: Low
         Component: Dissection engine (libwireshark)
        AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
        ReportedBy: johnx@xxxxxxxxx


Created attachment 9332
  --> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=9332
2 packets in question. #1 malformed, #2 displays dropped packetets

Build Information:
Pre-built x64 windows binaries and custom built x86 linux binaries.
--
When encountering malformed MPEG TS packet MP2T used to skip the malformed part
and parsed data behind the error. Current versions stops immediately after
errors.
It messes up CC based packet drop detection.

I can see two issues here:
1)The packet might not be malformed in the first place(works fine, but I'm no
expert in this field - attaching)
2)The less strict behavior is more desirable as packet drops are computed
separately of malformed packets.

MP2T in 1.7.0 displayed packet as:
ISO/IEC 13818-1 PID=0x21a CC=6
ISO/IEC 13818-1 PID=0x21c CC=6
ISO/IEC 13818-1 PID=0x21a CC=7
ISO/IEC 13818-1 PID=0xd49 CC=10
[Malformed Packet: MPEG PES]
ISO/IEC 13818-1 PID=0x21c CC=7
ISO/IEC 13818-1 PID=0x21a CC=8
ISO/IEC 13818-1 PID=0x7d5 CC=2

MP2T in 1.8.3 displays as follows:
ISO/IEC 13818-1 PID=0x21a CC=6
ISO/IEC 13818-1 PID=0x21c CC=6
ISO/IEC 13818-1 PID=0x21a CC=7
ISO/IEC 13818-1 PID=0xd49 CC=10
Packetized Elementary Stream
PES extension
PES header data: 29adf57025ffffffffffffffffffffffffffffffffffffff...
[Malformed Packet: MPEG PES]

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.