Hi,
Wireshark complains about bogus udp length when processing last fragment
of UDP data. It compares length field from UDP header with payload size
of last fragment.
Attached is my attempt to fix this by referring to tvp->length instead
of pinfo->iplen - pinfo->iphdrlen. Not entirely sure if it is the best
way, but appears to work for me.
Attached is also sample capture file. With reference to my earlier
message, do not worry about output above UDP layer.
http://www.wireshark.org/lists/wireshark-dev/200701/msg00265.html
Regards
Andrej
Attachment:
wccpfrag.pcap
Description: Binary data
Attachment:
udplen.gz
Description: application/gunzip
