Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 12568] Wireshark is marking BGP FlowSpec NLRI as malformed

Date: Thu, 30 Jun 2016 09:54:21 +0000

Comment # 25 on bug 12568 from
Looking at packet 2 update 3, there is something very strange:

BGP attributes length is coded 0x00f8 : 248 bytes,
NLRI length is calculated as : 243 bytes,

but

Flow spec NLRI length is coded 0xf201 (removing first nibble) : 513.

Difficult to have 513 bytes fitting into 243 bytes :) !

It is probably to early to jump to conclusion but there is chance that this
packet is malformed ...

Thoughts ?

Cheers Matt.


You are receiving this mail because:
  • You are watching all bug changes.