Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 10300] ERF/Ethernet-related bug where a FCS is not present

Date: Wed, 23 Jul 2014 16:51:36 +0000

Comment # 6 on bug 10300 from
(In reply to comment #5)
> To add though, why do you feel it is a capture/conversion issue..
> 
> If I open the same pcap file in 1.6.2 it dissects perfectly.

It dissects perfectly in 1.10.8 as well, provided you change your ERF protocol
preference "Ethernet Packets have FCS" to off. This preference may be preserved
between Wireshark install versions btw.

It is (potentially) a problem with the capture/conversion because ERF_TYPE_ETH
records are expected to contain an FCS, and this file does not. That is why the
dissector preference default is On. The preference was added to allow the user
to adapt if they have a file which does not have FCS. This should be a rare
case.


You are receiving this mail because:
  • You are watching all bug changes.