https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4200
Summary: Netflow dissector missing registration for total_ counts
Product: Wireshark
Version: SVN
Platform: Other
OS/Version: All
Status: NEW
Severity: Normal
Priority: Low
Component: Wireshark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: jasondev@xxxxxxxxxxx
Build Information:
Version 1.3.2 (SVN Rev 30807 from /trunk)
Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled with GTK+ 2.16.1, with GLib 2.20.1, with libpcap 1.0.0, with libz
1.2.3.3, without POSIX capabilities, without libpcre, without SMI, without
c-ares, without ADNS, without Lua, without Python, without GnuTLS, without
Gcrypt, without Kerberos, without GeoIP, without PortAudio, without AirPcap,
with new_packet_list.
NOTE: this build doesn't support the "matches" operator for Wireshark filter
syntax.
Running on Linux 2.6.28-16-generic, with libpcap version 1.0.0.
Built using gcc 4.3.3.
Wireshark is Open Source Software released under the GNU General Public
License.
Check the man page and http://www.wireshark.org for more information.
--
The netflow implementation has a bug where the code exists to extract four
fields from a packet, however, the decoder for these fields has not been
registered in proto_register_netflow in the hf_register_info array. If these
fields appear in a netflow packet the following error occurs:
Warn Dissector bug, protocol CFLOW, in packet 1: proto.c:1479: failed assertion
"(guint)hfindex < gpa_hfinfo.len"
The affected fields are:
hf_cflow_drop_total_octets
hf_cflow_drop_total_octets64
hf_cflow_drop_total_packets
hf_cflow_drop_total_packets64
The fix is to include decoders for the fields in the proto_register_netflow.
I've attached a pcap that demonstrates the problem - but it needs bug 4199 to
be fixed to expose the problem.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.