Jochen Bartl
changed
bug 6302
Comment # 11
on bug 6302
from Jochen Bartl
I had a look at both capture files and the frames marked by Wireshark as
"Malformed", are malformed indeed.
Capture 1 / bug6302-sample1.pcap
Frame 27:
Right after the flags field is a 1 byte "reserved" field, followed by a 2 byte
"links" field. However the links field is only 1 byte long in that case and
hence the frame is malformed.
http://tools.ietf.org/html/rfc2328#appendix-A.4.2
The links field with its 2 bytes is always there, but could have a value of 0
in case of Virtual Links for example.
Capture 2 / bug6302-sample2.pcap
Frame: 29 and 32
They both contain a Type 5 (AS-External) LSA which is supposed to always have a
4 byte "tag" field at the end. However it is only 3 bytes long which makes the
frame malformed.
Short summary:
Wireshark's length field calculations were in all cases correct, but your
captured malformed frames look like they are truncated by 1 byte. To me it
doesn't look like a Wireshark bug, but more like a bug in the software
generating those frames.
Best regards,
Jochen
Tested with: Version 1.11.0 (SVN Rev 52063 from master)
You are receiving this mail because:
- You are watching all bug changes.