Hi,
I've noticed that Frame 2 with the bad header checksum reaches my dissector
but Frame 3 with a LEN=0 doesn't actually reach my dissector (Stepping
though the code with VS 2008). Is this normal for WireShark??
Note: I have censored the IP's and MAC addresses.
Frame 2 (60 bytes on wire, 60 bytes captured)
Arrival Time: Jul 2, 2009 15:32:55.778125000
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 2
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp:data]
Ethernet II, Src: Wistron_11:11:11 (00:0a:e4:11:11:11), Dst: Cisco_22:22:22
(00:1e:7a:22:22:22)
Destination: Cisco_22:22:22 (00:1e:7a:22:22:22)
Address: Cisco_22:22:22 (00:1e:7a:22:22:22)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address
(factory default)
Source: Wistron_11:11:11 (00:0a:e4:11:11:11)
Address: Wistron_11:11:11 (00:0a:e4:11:11:11)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address
(factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.1.21.16 (10.1.21.16), Dst: 10.1.1.12 (10.1.1.12)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 46
Identification: 0x5ced (23789)
Flags: 0x02 (Don't Fragment)
0.. = Reserved bit: Not Set
.1. = Don't fragment: Set
..0 = More fragments: Not Set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0x0000 [incorrect, should be 0x1bb3]
[Good: False]
[Bad : True]
[Expert Info (Error/Checksum): Bad checksum]
[Message: Bad checksum]
[Severity level: Error]
[Group: Checksum]
Source: 10.1.21.16 (10.1.21.16)
Destination: 10.1.1.12 (10.1.1.12)
Transmission Control Protocol, Src Port: 21016 (21016), Dst Port: 4435
(4435), Seq: 1, Ack: 7, Len: 6
Source port: 21016 (21016)
Destination port: 4435 (4435)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
[Next sequence number: 7 (relative sequence number)]
Acknowledgement number: 7 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 64551
Checksum: 0x824a [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 1]
[Number of bytes in flight: 6]
MYPROTO Protocol
MYPROTO PDU Type: Unknown (0x80)
Data (6 bytes)
0000 80 00 20 21 10 80 .. !..
Data: 800020211080
[Length: 6]
Frame 3 (60 bytes on wire, 60 bytes captured)
Arrival Time: Jul 2, 2009 15:32:56.106250000
[Time delta from previous captured frame: 0.328125000 seconds]
[Time delta from previous displayed frame: 0.328125000 seconds]
[Time since reference or first frame: 0.328125000 seconds]
Frame Number: 3
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
Ethernet II, Src: Cisco_22:22:22 (00:1e:7a:22:22:22), Dst: Wistron_11:11:11
(00:0a:e4:11:11:11)
Destination: Wistron_11:11:11 (00:0a:e4:11:11:11)
Address: Wistron_11:11:11 (00:0a:e4:11:11:11)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address
(factory default)
Source: Cisco_36:6d:a5 (00:1e:7a:22:22:22)
Address: Cisco_36:6d:a5 (00:1e:7a:22:22:22)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address
(factory default)
Type: IP (0x0800)
Trailer: 000000000000
Internet Protocol, Src: 10.1.1.12 (10.1.1.12), Dst: 10.1.21.16 (10.1.21.16)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0xb170 (45424)
Flags: 0x02 (Don't Fragment)
0.. = Reserved bit: Not Set
.1. = Don't fragment: Set
..0 = More fragments: Not Set
Fragment offset: 0
Time to live: 123
Protocol: TCP (0x06)
Header checksum: 0xcc35 [correct]
[Good: True]
[Bad : False]
Source: 10.1.1.12 (10.1.1.12)
Destination: 10.1.21.16 (10.1.21.16)
Transmission Control Protocol, Src Port: 4435 (4435), Dst Port: 21016
(21016), Seq: 7, Ack: 7, Len: 0
Source ////////// 4////////// 5port: 4435 (4435)
Destination port: 21016 (21016)
[Stream index: 0]
Sequence number: 7 (relative sequence number)
Acknowledgement number: 7 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 65382
Checksum: 0x6280 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 2]
[The RTT to ACK the segment was: 0.328125000 seconds]
