To wireshark devs:
Im trying to investigate if IPv6 fragmentation offset should be interpreted as 13-bit int? or a 16-bit?
see section 4.5 of RFC 2460
packet-ipv6.h
#define IP6F_OFF_MASK 0xfff8 /* mask out offset from _offlg */
packet-ipv6.c
{ &hf_ipv6_frag_offset,
{ "Offset", "ipv6.fragment.offset",
FT_UINT16, BASE_DEC_HEX, NULL, IP6F_OFF_MASK,
"Fragment Offset", HFILL }},
However it is conflicting with the fragment's reassemble information.
Steps:
1. view frame#4 of the attached capture
2. notice under the IPv6 Fragments subtree,
[IPv6 Fragments (5008 bytes): #1(1448), #2(1448), #3(1448), #4(664)]
[Frame: 1, payload: 0-1447 (1448 bytes)]
[Frame: 2, payload: 1448-2895 (1448 bytes)]
[Frame: 3, payload: 2896-4343 (1448 bytes)]
[Frame: 4, payload: 4344-5007 (664 bytes)]
3. go to frame#3 under Fragmentation Header subtree
notice that the offset is
0001 0000 1111 1... = Offset: 543 (0x021f)
should'nt this be?
2896?
the fix is to change hf_ipv6_frag_offset IP6_OFF_MASK to 0x0 (not ipv6.h)
Thanks!
Attachment:
ipv6-fragment-header.cap
Description: application/cap
