Build Information:
[root@FADU020 wireshark-2.2.0]# wireshark -v
wireshark 1.10.14 (Git Rev Unknown from unknown)
Copyright 1998-2015 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GTK+ 2.24.28, with Cairo 1.14.2, with Pango 1.36.8, with
GLib 2.42.2, with libpcap, with libz 1.2.7, with POSIX capabilities (Linux),
without libnl, with SMI 0.4.8, with c-ares 1.10.0, with Lua 5.1, without
Python,
with GnuTLS 3.3.8, with Gcrypt 1.5.3, with MIT Kerberos, without GeoIP, without
PortAudio, with AirPcap.
Running on Linux 3.10.0-123.el7.x86_64, with locale en_US.UTF-8, with libpcap
version 1.5.3, with libz 1.2.7, GnuTLS 3.3.8, Gcrypt 1.5.3, without AirPcap.
Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Built using gcc 4.8.5 20150623 (Red Hat 4.8.5-4).
[root@FADU020 wireshark-2.2.0]# tshark -v
TShark 1.10.14 (Git Rev Unknown from unknown)
Copyright 1998-2015 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GLib 2.42.2, with libpcap, with libz 1.2.7, with POSIX
capabilities (Linux), without libnl, with SMI 0.4.8, with c-ares 1.10.0, with
Lua 5.1, without Python, with GnuTLS 3.3.8, with Gcrypt 1.5.3, with MIT
Kerberos, without GeoIP.
Running on Linux 3.10.0-123.el7.x86_64, with locale en_US.UTF-8, with libpcap
version 1.5.3, with libz 1.2.7.
Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Built using gcc 4.8.5 20150623 (Red Hat 4.8.5-4).
[root@FADU020 wireshark-2.2.0]#
Using CentOS 7
--
Problematic point:
<field name="dhcpv6.option.type" showname="Option: Unknown (53)" size="2"
pos="66" show="53" value="0035"/>
Output of tshark -r /usr/local/option_53_packet_alone.pcap -T pdml
<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href=""
<!-- You can find pdml2html.xsl in /usr/share/wireshark or at
http://anonsvn.wireshark.org/trunk/wireshark/pdml2html.xsl. -->
<pdml version="0" creator="wireshark/1.10.14" time="Thu Sep 15 20:55:02 2016"
capture_file="/usr/local/option_53_packet_alone.pcap">
<packet>
<proto name="geninfo" pos="0" showname="General information" size="74">
<field name="num" pos="0" show="1" showname="Number" value="1" size="74"/>
<field name="len" pos="0" show="74" showname="Frame Length" value="4a"
size="74"/>
<field name="caplen" pos="0" show="74" showname="Captured Length"
value="4a" size="74"/>
<field name="timestamp" pos="0" show="Aug 24, 2016 12:40:24.342115000 IST"
showname="Captured Time" value="1472022624.342115000" size="74"/>
</proto>
<proto name="frame" showname="Frame 1: 74 bytes on wire (592 bits), 74 bytes
captured (592 bits)" size="74" pos="0">
<field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)"
size="0" pos="0" show=""/>
<field name="frame.time" showname="Arrival Time: Aug 24, 2016
12:40:24.342115000 IST" size="0" pos="0" show=""Aug 24, 2016
12:40:24.342115000 IST""/>
<field name="frame.offset_shift" showname="Time shift for this packet:
0.000000000 seconds" size="0" pos="0" show="0.000000000"/>
<field name="frame.time_epoch" showname="Epoch Time: 1472022624.342115000
seconds" size="0" pos="0" show="1472022624.342115000"/>
<field name="frame.time_delta" showname="Time delta from previous captured
frame: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/>
<field name="frame.time_delta_displayed" showname="Time delta from previous
displayed frame: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/>
<field name="frame.time_relative" showname="Time since reference or first
frame: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/>
<field name="frame.number" showname="Frame Number: 1" size="0" pos="0"
show="1"/>
<field name="frame.len" showname="Frame Length: 74 bytes (592 bits)"
size="0" pos="0" show="74"/>
<field name="frame.cap_len" showname="Capture Length: 74 bytes (592 bits)"
size="0" pos="0" show="74"/>
<field name="frame.marked" showname="Frame is marked: False" size="0"
pos="0" show="0"/>
<field name="frame.ignored" showname="Frame is ignored: False" size="0"
pos="0" show="0"/>
<field name="frame.protocols" showname="Protocols in frame:
eth:ipv6:udp:dhcpv6" size="0" pos="0" show="eth:ipv6:udp:dhcpv6"/>
</proto>
<proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:01
(00:00:00:00:00:01), Dst: Private_00:00:01 (10:00:00:00:00:01)" size="14"
pos="0">
<field name="eth.dst" showname="Destination: Private_00:00:01
(10:00:00:00:00:01)" size="6" pos="0" show="10:00:00:00:00:01"
value="100000000001">
<field name="eth.addr" showname="Address: Private_00:00:01
(10:00:00:00:00:01)" size="6" pos="0" show="10:00:00:00:00:01"
value="100000000001"/>
<field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit:
Globally unique address (factory default)" size="3" pos="0" show="0" value="0"
unmaskedvalue="100000"/>
<field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit:
Individual address (unicast)" size="3" pos="0" show="0" value="0"
unmaskedvalue="100000"/>
</field>
<field name="eth.src" showname="Source: 00:00:00_00:00:01
(00:00:00:00:00:01)" size="6" pos="6" show="00:00:00:00:00:01"
value="000000000001">
<field name="eth.addr" showname="Address: 00:00:00_00:00:01
(00:00:00:00:00:01)" size="6" pos="6" show="00:00:00:00:00:01"
value="000000000001"/>
<field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit:
Globally unique address (factory default)" size="3" pos="6" show="0" value="0"
unmaskedvalue="000000"/>
<field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit:
Individual address (unicast)" size="3" pos="6" show="0" value="0"
unmaskedvalue="000000"/>
</field>
<field name="eth.type" showname="Type: IPv6 (0x86dd)" size="2" pos="12"
show="34525" value="86dd"/>
</proto>
<proto name="ipv6" showname="Internet Protocol Version 6, Src: :: (::), Dst:
10:: (10::)" size="40" pos="14">
<field name="ipv6.version" showname="0110 .... = Version: 6" size="1"
pos="14" show="6" value="6" unmaskedvalue="60">
<field name="ip.version" showname="0110 .... = This field makes the
filter "ip.version == 6" possible: 6" size="1" pos="14" show="6"
value="6" unmaskedvalue="60"/>
</field>
<field name="ipv6.class" showname=".... 0000 0000 .... .... .... .... ....
= Traffic class: 0x00000000" size="4" pos="14" show="0" value="0"
unmaskedvalue="60000000">
<field name="ipv6.traffic_class.dscp" showname=".... 0000 00.. .... ....
.... .... .... = Differentiated Services Field: Default (0x00000000)" size="4"
pos="14" show="0" value="0" unmaskedvalue="60000000"/>
<field name="ipv6.traffic_class.ect" showname=".... .... ..0. .... ....
.... .... .... = ECN-Capable Transport (ECT): Not set" size="4" pos="14"
show="0" value="0" unmaskedvalue="60000000"/>
<field name="ipv6.traffic_class.ce" showname=".... .... ...0 .... ....
.... .... .... = ECN-CE: Not set" size="4" pos="14" show="0" value="0"
unmaskedvalue="60000000"/>
</field>
<field name="ipv6.flow" showname=".... .... .... 0000 0000 0000 0000 0000 =
Flowlabel: 0x00000000" size="4" pos="14" show="0" value="0"
unmaskedvalue="60000000"/>
<field name="ipv6.plen" showname="Payload length: 20" size="2" pos="18"
show="20" value="0014"/>
<field name="ipv6.nxt" showname="Next header: UDP (17)" size="1" pos="20"
show="17" value="11"/>
<field name="ipv6.hlim" showname="Hop limit: 64" size="1" pos="21"
show="64" value="40"/>
<field name="ipv6.src" showname="Source: :: (::)" size="16" pos="22"
show="::" value="00000000000000000000000000000000"/>
<field name="ipv6.addr" showname="Source or Destination Address: :: (::)"
hide="yes" size="16" pos="22" show="::"
value="00000000000000000000000000000000"/>
<field name="ipv6.src_host" showname="Source Host: ::" hide="yes" size="16"
pos="22" show="::" value="00000000000000000000000000000000"/>
<field name="ipv6.host" showname="Source or Destination Host: ::"
hide="yes" size="16" pos="22" show="::"
value="00000000000000000000000000000000"/>
<field name="ipv6.dst" showname="Destination: 10:: (10::)" size="16"
pos="38" show="10::" value="00100000000000000000000000000000"/>
<field name="ipv6.addr" showname="Source or Destination Address: 10::
(10::)" hide="yes" size="16" pos="38" show="10::"
value="00100000000000000000000000000000"/>
<field name="ipv6.dst_host" showname="Destination Host: 10::" hide="yes"
size="16" pos="38" show="10::" value="00100000000000000000000000000000"/>
<field name="ipv6.host" showname="Source or Destination Host: 10::"
hide="yes" size="16" pos="38" show="10::"
value="00100000000000000000000000000000"/>
</proto>
<proto name="udp" showname="User Datagram Protocol, Src Port: dhcpv6-client
(546), Dst Port: dhcpv6-server (547)" size="8" pos="54">
<field name="udp.srcport" showname="Source port: dhcpv6-client (546)"
size="2" pos="54" show="546" value="0222"/>
<field name="udp.dstport" showname="Destination port: dhcpv6-server (547)"
size="2" pos="56" show="547" value="0223"/>
<field name="udp.port" showname="Source or Destination Port: 546"
hide="yes" size="2" pos="54" show="546" value="0222"/>
<field name="udp.port" showname="Source or Destination Port: 547"
hide="yes" size="2" pos="56" show="547" value="0223"/>
<field name="udp.length" showname="Length: 20" size="2" pos="58" show="20"
value="0014"/>
<field name="udp.checksum_coverage" showname="Checksum coverage: 20"
hide="yes" size="0" pos="58" show="20"/>
<field name="udp.checksum" showname="Checksum: 0x8f8b [validation
disabled]" size="2" pos="60" show="36747" value="8f8b">
<field name="udp.checksum_good" showname="Good Checksum: False" size="2"
pos="60" show="0" value="8f8b"/>
<field name="udp.checksum_bad" showname="Bad Checksum: False" size="2"
pos="60" show="0" value="8f8b"/>
</field>
</proto>
<proto name="dhcpv6" showname="DHCPv6" size="12" pos="62">
<field name="dhcpv6.msgtype" showname="Message type: Request (3)" size="1"
pos="62" show="3" value="03"/>
<field name="dhcpv6.xid" showname="Transaction ID: 0x000001" size="3"
pos="63" show="1" value="000001"/>
<field name="" show="DHCP option 53" size="8" pos="66"
value="0035000412345678">
<field name="dhcpv6.option.type" showname="Option: Unknown (53)" size="2"
pos="66" show="53" value="0035"/>
<field name="dhcpv6.option.length" showname="Length: 4" size="2" pos="68"
show="4" value="0004"/>
<field name="dhcpv6.option.value" showname="Value: 12345678" size="4"
pos="70" show="12:34:56:78" value="12345678"/>
<field name="dhcpv6.duid.bytes" showname="DUID: 12345678" size="4"
pos="70" show="12:34:56:78" value="12345678"/>
<field name="dhcpv6.duid.type" showname="DUID Type: Unknown (4660)"
size="2" pos="70" show="4660" value="1234"/>
</field>
</proto>
</packet>
</pdml>