Wireshark-bugs: [Wireshark-bugs] [Bug 10611] Malformed PTPoE announce packet

Date: Mon, 22 Dec 2014 01:05:51 +0000

Comment # 8 on bug 10611 from
(In reply to Stephen Donnelly from comment #7)
> I am confused by the addition of ptp.v2.an.fcs in 0af4395e.
> 
> What fcs does this field refer to in IEEE 1588? Is this fcs Announce message
> specific?
> 
> I am getting Malformed Packet exceptions due to this, and I suspect that it
> is in fact referring to the Ethernet FCS. If so this is a layer violation as
> that should be handled by the Ethernet dissector already.

Note this can be easily demonstrated with the attached trace file supplied by
Yossi, which appears to be captured with Ethernet FCS bytes.

If 'Preferences->Protocols->Ethernet->Assume packets have FCS' is set, all
packets captured are shown as having an FCS under Ethernet, and if 'Validate
the Ethernet checksum if possible' is set all Ethernet checksums are validated
as correct.

The byte ranges for the Ethernet trailer (FCS) and PTP payload are correct for
all packets except Announce packets.

All Announce packets are marked as Malformed as the 4 bytes for 'ptp.v2.an.fcs'
are no longer available as the Ethernet dissector has already consumed them.

I believe ptp.v2.an.fcs should be backed out.


You are receiving this mail because:
  • You are watching all bug changes.