https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5741
Jaap Keuter <jaap.keuter@xxxxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |INVALID
--- Comment #8 from Jaap Keuter <jaap.keuter@xxxxxxxxx> 2011-03-07 13:23:24 CET ---
(In reply to comment #7)
> (From update of attachment 6001 [details])
> ... Don’t you think that's a little
> strange?
> I only observed this phenomena with ICMP packets.
No this is not strange. Expand the whole ICMP packet, including it's payload.
There you'll see a copy of (the beginning of) the offending packet prompting
the generation of the ICMP packet. This (beginning of) the offending packet is
dissected as well, resulting in the generation of a field “ip.dsfield.dscp”
with the value “0x10”. This in addition to the field “ip.dsfield.dscp” with the
value “0x00” from the ICMP header itself.
So there are two “ip.dsfield.dscp” fields in this packet. The display filter
engine is greedy as it's called, going through all fields to make sure it finds
a match. It does not stop at the first mismatch.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.