Wireshark-bugs: [Wireshark-bugs] [Bug 10519] New: tcp.len zero for bad frame length

Date: Wed, 01 Oct 2014 12:47:26 +0000
Bug ID 10519
Summary tcp.len zero for bad frame length
Product Wireshark
Version 1.12.1
Hardware x86-64
OS Windows 7
Status UNCONFIRMED
Severity Major
Priority Low
Component Dissection engine (libwireshark)
Assignee [email protected]
Reporter [email protected]

Created attachment 13108 [details]
tcp length zero

Build Information:
Version 1.12.1 (v1.12.1-0-g01b65bf from master-1.12)

Copyright 1998-2014 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.23, with Cairo 1.10.2, with Pango 1.34.0, with
GLib 2.38.0, with WinPcap (4_1_3), with libz 1.2.5, with SMI 0.4.8, with c-ares
1.9.1, with Lua 5.2, without Python, with GnuTLS 3.1.22, with Gcrypt 1.6.0,
without Kerberos, with GeoIP, with PortAudio V19-devel (built Sep 16 2014),
with
AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with WinPcap version
4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch
1_0_rel0b (20091008), GnuTLS 3.1.22, Gcrypt 1.6.0, without AirPcap.
      Intel(R) Core(TM) i7-3740QM CPU @ 2.70GHz, with 16315MB of physical
memory.


Built using Microsoft Visual C++ 10.0 build 40219
--
For TCP, tcp.len is zero when frame length=58 and ip length=1498.  UDP appears
to recognize the frame length is incorrect and uses the ip length.

Since Riverbed ATX calls wireshark to decode packets, it's tcp lengths are
incorrect too.


You are receiving this mail because:
  • You are watching all bug changes.