https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4470
Summary: "L2 COS Value (802.1p)" column does not always display
the correct value
Product: Wireshark
Version: 1.2.6
Platform: x86
OS/Version: Mac OS X 10.5
Status: NEW
Severity: Normal
Priority: Low
Component: Wireshark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: daniel.kerse@xxxxxxxxx
Created an attachment (id=4280)
--> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=4280)
Both packets in this pcap have the same .1p, but they display differently
Build Information:
Version 1.2.6 (SVN Rev 31702)
Copyright 1998-2010 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled with GTK+ 2.12.9, with GLib 2.16.3, with libpcap 0.9.5, with libz
1.2.3, without POSIX capabilities, with libpcre 7.8, with SMI 0.4.8, with
c-ares
1.5.3, with Lua 5.1, with GnuTLS 2.6.2, with Gcrypt 1.4.3, with MIT Kerberos,
without GeoIP, with PortAudio V19-devel (built Nov 14 2008), without AirPcap.
Running on Darwin 9.8.0 (MacOS 10.5.8), with libpcap version 0.9.5, GnuTLS
2.6.2, Gcrypt 1.4.3.
Built using gcc 4.0.1 (Apple Inc. build 5488).
Wireshark is Open Source Software released under the GNU General Public
License.
Check the man page and http://www.wireshark.org for more information.
--
To reproduce:
Edit -> Preferences -> Layout -> Columns
Add a new column with field type "L2 COS (802.1p)". Apply the change.
Open the attached pcap file.
The first packet is from a RFC2547 traffic stream and the second is from a
martini traffic stream (draft-martini-l2circuit-encap-mpls-08.txt). Every
packet in the Martini stream shows this same anomaly. Both packets in the
attached file have the same 802.1p value, but they display differently.
For the second (i.e. Martini) packet, the dot1p value shown in the "Packet
List" area (via the newly created column) does not match the value shown in the
"Packet Details" area.
Also I notice tshark also lists the same value as the "Packet List" area in
Wireshark, however tcpdump agrees with the "Packet Details" area of Wireshark -
see below.
$ tshark -e vlan -Tfields -r dot1p-displayerror.pcap
802.1Q Virtual LAN, PRI: 3, CFI: 0, ID: 501
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 901
PRI = 3, 0
$ tcpdump -enr dot1p-displayerror.pcap
reading from file dot1p-displayerror.pcap, link-type EN10MB (Ethernet)
14:06:32.244786 00:90:1a:40:9d:6c > 00:90:69:d5:78:3e, ethertype 802.1Q
(0x8100), length 1524: vlan 501, p 3, ethertype MPLS unicast, MPLS (label
100288, exp 5, ttl 255)
(label 37, exp 5, [S], ttl 255), IP, length: 1506
11:51:57.974800 00:90:1a:40:9d:6c > 00:90:69:d5:78:3e, ethertype 802.1Q
(0x8100), length 1542: vlan 501, p 3, ethertype MPLS unicast, MPLS (label
100288, exp 4, ttl 254)
(label 57, exp 4, [S], ttl 255)
p = 3, 3
$ tcpdump -V
tcpdump version 3.9.7
libpcap version 0.9.5
Usage: tcpdump [-aAdDefKlLnNOpqRStuUvxX] [-c count] [ -C file_size ]
[ -E algo:secret ] [ -F file ] [ -i interface ] [ -M secret ]
[ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
[ -W filecount ] [ -y datalinktype ] [ -Z user ]
[ expression ]
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.