Wireshark-bugs: [Wireshark-bugs] [Bug 6302] OSPF LSA length minimum values
Date: Mon, 30 Sep 2013 20:54:20 +0000
Jochen Bartl changed bug 6302
What | Removed | Added |
---|---|---|
CC | [email protected] |
Comment # 11
on bug 6302
from Jochen Bartl
I had a look at both capture files and the frames marked by Wireshark as "Malformed", are malformed indeed. Capture 1 / bug6302-sample1.pcap Frame 27: Right after the flags field is a 1 byte "reserved" field, followed by a 2 byte "links" field. However the links field is only 1 byte long in that case and hence the frame is malformed. http://tools.ietf.org/html/rfc2328#appendix-A.4.2 The links field with its 2 bytes is always there, but could have a value of 0 in case of Virtual Links for example. Capture 2 / bug6302-sample2.pcap Frame: 29 and 32 They both contain a Type 5 (AS-External) LSA which is supposed to always have a 4 byte "tag" field at the end. However it is only 3 bytes long which makes the frame malformed. Short summary: Wireshark's length field calculations were in all cases correct, but your captured malformed frames look like they are truncated by 1 byte. To me it doesn't look like a Wireshark bug, but more like a bug in the software generating those frames. Best regards, Jochen Tested with: Version 1.11.0 (SVN Rev 52063 from master)
You are receiving this mail because:
- You are watching all bug changes.
- Prev by Date: [Wireshark-bugs] [Bug 9195] DNP3 Dissector Enhancements and Bug Fixes
- Previous by thread: [Wireshark-bugs] [Bug 8879] HSMS protocol dissector plugin bug
- Index(es):
- Get Wireshark
- Download
- Code of Conduct