| Bug ID |
11776
|
| Summary |
Add support for RFC 2507 IP Header Compression Non TCP
|
| Product |
Wireshark
|
| Version |
unspecified
|
| Hardware |
x86
|
| OS |
All
|
| Status |
UNCONFIRMED
|
| Severity |
Enhancement
|
| Priority |
Low
|
| Component |
Dissection engine (libwireshark)
|
| Assignee |
[email protected]
|
| Reporter |
[email protected]
|
Created attachment 14032 [details]
One compressed stream with both Non TCP and full header packets
Build Information:
Wireshark 2.1.0 (v2.1.0rc0-754-gdcfea6a from unknown)
Copyright 1998-2015 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GTK+ 2.24.23, with Cairo 1.8.8, with Pango 1.28.1, with
libpcap, without POSIX capabilities, with libnl 3, with libz 1.2.3, with GLib
2.28.8, without SMI, with c-ares 1.10.0, with Lua 5.1, without GnuTLS, with
Gcrypt 1.4.5, without Kerberos, with GeoIP, with PortAudio V19-devel (built Jul
8 2010), without AirPcap.
Running on Linux 2.6.32-573.7.1.el6.x86_64, with locale en_US.UTF-8, with
libpcap version 1.4.0, with libz 1.2.3, with Gcrypt 1.4.5.
Intel(R) Core(TM) i5-3340M CPU @ 2.70GHz (with SSE4.2)
Built using gcc 4.4.7 20120313 (Red Hat 4.4.7-16).
--
I have a capture which implements IP Header Compression over PPP (PPP MP,
precisely) of UDP packets containing payload but as the original RFC 2507 spec
instead of RFC 2508. It sets the D bit to zero and doesn't put the sequence
nibble in the data field. It then sends the compressed packets using as
Compressed Non TCP according to RFC 2507, using PPP protocol 0x0065.
Right now wireshark doesn't support RTP IPHC Full Header packets if the D bit
is zero, and doesn't support Compressed Non TCP packets at all.
I'll attach a sample where I filtered out a stream with one CID and generation.
I have a patch to support it which I've fuzz tested and I'll commit.
You are receiving this mail because:
- You are watching all bug changes.