Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 9931] Encapsulated ethernet packets sometimes show invalid

Date: Thu, 27 Mar 2014 22:17:11 +0000

changed bug 9931

What Removed Added
Hardware x86 All

Comment # 1 on bug 9931 from
(In reply to comment #0)
> 2) Even if the file reader had set the pseudo-header,

...which they all should do...

> if the lower
> link-layer encap wasn't Ethernet but something else like ATM, it would set
> the ATM-specific pseudo-header info.  But when the ATM cells contain an
> Ethernet packet inside, ATM's dissector doesn't call the dissector for
> "eth_withoutfcs" or "eth_withfcs", which I believe it should do,

You are correct.

*NO* dissector for a protocol over which Ethernet can be encapsulated should
call the "eth" dissector, with the possible exception of protocols for remote
packet capture.  Perhaps that dissector should be renamed "eth_maybefcs" to
clarify that it's not "the" Ethernet dissector.

I'd be inclined to split this into two bugs:

   1) a libwiretap bug for the file-reading modules that aren't setting the
pseudo-header;

   2) a libwireshark bug for the dissectors calling the "eth" dissector - and
for renaming the "eth" dissector to "eth_maybefcs".


You are receiving this mail because:
  • You are watching all bug changes.