Comment # 3
on bug 8362
from Jaap Keuter
That's not a wrong checksum calculation, that's wrong use of the Fragment EH.
This repeated use of the Fragment EH (M=0) tricks Wireshark into believing the
packet is complete and it sets out processing the rest of the data as if it
were complete. In this specific case the ICMPv6 dissector calculates the
checksum over what it believes is a complete packet.
What Wireshark should do is only allow dissection of EH's after a Fragment EH
with M-bit set, but no payload. It could even flag repeated use of Fragment EH
as noteworthy event, possible protocol attack.
You are receiving this mail because:
- You are watching all bug changes.