http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2290
Summary: GPRS LLC CRC24 badly calculated for non protected frames
Product: Wireshark
Version: 0.99.7
Platform: PC
OS/Version: Windows XP
Status: NEW
Severity: Minor
Priority: Low
Component: Wireshark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: vincent.helfre@xxxxxxx
Build Information:
Version 0.99.7 (SVN Rev 23910)
Copyright 1998-2007 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled with GTK+ 2.12.1, with GLib 2.14.3, with WinPcap (version unknown),
with libz 1.2.3, with libpcre 6.4, with SMI 0.4.5, with ADNS, with Lua 5.1,
with
GnuTLS 1.6.1, with Gcrypt 1.2.3, with MIT Kerberos, with PortAudio PortAudio
V19-devel, with AirPcap.
Running on Windows XP Service Pack 2, build 2600, with WinPcap version 4.0.2
(packet.dll version 4.0.0.1040), based on libpcap version 0.9.5, without
AirPcap.
Built using Microsoft Visual C++ 6.0 build 8804
Wireshark is Open Source Software released under the GNU General Public
License.
Check the man page and http://www.wireshark.org for more information.
--
Hi,
There is some wrong warnings indicated about incorrect LLC FCS in wireshark,
whereas it is correct. This happens for unprotected LLC frames where this CRC
shall not be calculated on the whole frame, but on the LLC header (3 bytes)+
MIN(N202,L3 length)) (where N202 is 4 bytes).
extract from the 44.064
5.5 Frame Check Sequence (FCS) field
The FCS field shall consist of a 24 bit cyclic redundancy check (CRC) code. The
CRC-24 is used to detect bit errors in the frame header and information fields.
The FCS field contains the value of a CRC calculation that is performed over
the entire contents of the header and information field, except for UI frames
transmitted in unprotected mode, in which case the FCS field contains the value
of a CRC calculation that is performed over the frame header and the first N202
octets (see subclause 8.9.6) of the information field only (see subclause
6.3.5.5.2).
if (tvb_length(tvb) >= length && length >= 3)
{
/*
* We have all the packet data, including the full FCS,
* so we can compute the FCS.
*
* XXX - do we need to check the PM bit?
*/
crc_start = length-3;
fcs_calc = crc_calc ( INIT_CRC24 , tvb, crc_start );
fcs_calc = ~fcs_calc;
fcs_calc &= 0xffffff;
fcs = tvb_get_letoh24(tvb, crc_start);
if ( fcs_calc == fcs )
{
fcs_status = FCS_VALID;
}
else
{
fcs_status = FCS_NOT_VALID;
}
}
This should be changed to check the PM bit for UI frame before going for
processing. If PM bit is not set, then crc_start should be set to MIN(3+4,
length-3)
I can provide log if needed.
--
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.