http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1454
jeff.morriss@xxxxxxxxxxx changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |INVALID
------- Comment #3 from jeff.morriss@xxxxxxxxxxx 2007-03-24 13:07 GMT -------
(In reply to comment #0)
> I'm not sure whether it's a problem and if - whether it's a wireshark problem
> or a problem of my Gentoo system:
If so you'd probably be better served asking the users mailing list--the bug
tracker is for things you're at least pretty sure is a bug in Wireshark and
anyway you'd get a larger audience on the mailing list. :-)
> I'm wondering why all messenger packets looks nice if I choose ppp0 as an
> interface whereas each messenger packets is market as malformed if I choose
> eth0 as an interface.
>
> Sometimes ago I filed bug #1270 which might be related to this effect - I
> didn't realized at that time that the packets are malformed only if eth0 was
> choosed.
>
> Or is the described behaviour a side effect from "UDP checksum offload" of my
> e1000 card ?
No, it has nothing to do with checksum offloading but is similar to bug 1271:
the problem here is that on the eth0 capture UDP says the length of the packet
is 452 bytes but that there's only 196 bytes of payload (UDP accurately says
"Length: 452 (bogus, payload length 196)").
The frame dissector says "494 bytes on wire, 494 bytes captured" which _should_
mean the packet wasn't cut short during capturing for some reason.
However, if you look at the text of Messenger message in the bytes pane, you'll
note that all the eth0 messages are cut short.
My guess is that your eth0 is truncating packets and not telling anybody.
Anyway, it's not a problem in Wireshark from what I can see.
--
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.