ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 10493] New: openflow_v1 OFPT_FEATUERS_REPLY parsed incorre

Date: Mon, 22 Sep 2014 18:27:08 +0000
Bug ID 10493
Summary openflow_v1 OFPT_FEATUERS_REPLY parsed incorrectly
Product Wireshark
Version 1.12.1
Hardware x86-64
OS Windows 7
Status UNCONFIRMED
Severity Normal
Priority Low
Component Dissection engine (libwireshark)
Assignee [email protected]
Reporter [email protected]

Build Information:
Version 1.12.1 (v1.12.1-0-g01b65bf from master-1.12)

Copyright 1998-2014 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.23, with Cairo 1.10.2, with Pango 1.34.0, with
GLib 2.38.0, with WinPcap (4_1_3), with libz 1.2.5, with SMI 0.4.8, with c-ares
1.9.1, with Lua 5.2, without Python, with GnuTLS 3.1.22, with Gcrypt 1.6.0,
without Kerberos, with GeoIP, with PortAudio V19-devel (built Sep 16 2014),
with
AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with WinPcap version
4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch
1_0_rel0b (20091008), GnuTLS 3.1.22, Gcrypt 1.6.0, without AirPcap.
Intel(R) Core(TM) i5-4670K CPU @ 3.40GHz, with 16321MB of physical memory.


Built using Microsoft Visual C++ 10.0 build 40219

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
As shown on page 4 of
http://archive.openflow.org/wk/images/c/c5/Openflow_packet_format.pdf

under "Protocol Payload Format - Features Reply"
the specification shows 3 bytes of zeros as reserved just before the "switch
capability flags"

Wireshark dissects the Features Reply packet with these reserved bytes
occurring at the end of the stream, which is incorrect, causing much of the
packet to be offset by 3 bytes and consequently misinterpreted.


You are receiving this mail because:
  • You are watching all bug changes.