["Martin Regner" <martin.regner@xxxxxxxxx>]

Alois Heilmaier wrote:
<When try to decode a PIM JOIN/PRUNE message I will get only one multicast
<group entry but there should be 2 multicast-groups.
<If you look at the decode you will see thath there is only the first group
<address seen.
<The second group addresse (224.0.1.40 == e0 00 01 28 hex) does not appear in
<the decode but in the hex code I see the rest of
<the PIM packet.

There seems to be a fault in packet-pim.c.
The offset variable is not set to the correct value in the ngroup loop what I can see.

I made a small change by replacing the lines (dissect_pim):
      off += advance;
  }
     }
    breakbreak3:

with the lines:
      off += advance;
  }
  offset = off;
     }
    breakbreak3:

... and then it seems that the dissection works correctly for your capture.


Protocol Independent Multicast
    Version: 2
    Type: Join/Prune (3)
    Checksum: 0x0408 (correct)
    PIM parameters
        Upstream-neighbor: 2.205.250.2
        Groups: 2
        Holdtime: 210
        Group 0: 224.0.1.39/32
            Join: 1
                IP address: 2.205.254.2/32 (SWR)
            Prune: 0
        Group 1: 224.0.1.40/32
            Join: 1
                IP address: 2.205.254.2/32 (SWR)
            Prune: 2
                IP address: 2.205.250.2/32 (S)
                IP address: 2.205.250.1/32 (S)

There seems to be a similar fault in dissect_pimv1.