http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1832
Summary: Incorrect Report of Malformed UDP packet In an ICMP Dest
Unreachable
Product: Wireshark
Version: 0.99.6
Platform: PC
OS/Version: Windows XP
Status: NEW
Severity: Major
Priority: Low
Component: Wireshark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: keithfrench@xxxxxxxxxxxxx
Build Information:
0.99.6a
--
When you view the Expert Info Composite on a trace that has an ICMP Destination
Unreachable (Port Unreachable) packet in it, you can see a report of a
malformed UDP packet where it has a Bad length value > IP payload length. This
is particularly noticed if the packet that the ICMP is reporting on is an SNMP
trap and the destination has no trap watcher software running.
The ICMP contains the IP header of the original datagram and if you drill down
the protocol tree window it can be seen that it reports that the UDP length as
bogus, which is wrong:-
Internet Control Message Protocol
Type: 3 (Destination unreachable)
Code: 3 (Port unreachable)
Checksum: 0xd84a [correct]
Internet Protocol, Src: 168.10.5.10 (168.10.5.10), Dst: 168.10.5.6
(168.10.5.6)
User Datagram Protocol, Src Port: 6996 (6996), Dst Port: 6996 (6996)
Source port: 6996 (6996)
Destination port: 6996 (6996)
Length: 16 (bogus, payload length 8)
Checksum: 0xedf9
This was not a problem in version 0.99.4.
--
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.