Wireshark-bugs: [Wireshark-bugs] [Bug 13122] New: "Decode as" on a packet isn't working for DCER

Date: Fri, 11 Nov 2016 12:58:59 +0000
Bug ID 13122
Summary "Decode as" on a packet isn't working for DCERPC/SPOOLSS with the Qt frontend
Product Wireshark
Version 2.2.1
Hardware x86
OS All
Status UNCONFIRMED
Severity Major
Priority Low
Component Qt UI
Assignee [email protected]
Reporter [email protected]

Created attachment 15059 [details]
wireshark_decode_as_spoolss_frame8.pcap

Build Information:
Wireshark 2.2.1 (Git Rev Unknown from unknown)

Copyright 1998-2016 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.7.0, with libpcap, with POSIX capabilities (Linux),
with libnl 3, with GLib 2.50.0, with zlib 1.2.8, with SMI 0.4.8, with c-ares
1.11.0, with Lua 5.2.4, with GnuTLS 3.4.15, with Gcrypt 1.7.3, with MIT
Kerberos, with GeoIP, with QtMultimedia, without AirPcap.

Running on Linux 4.8.6-2-default, with locale LC_CTYPE=en_US.UTF-8,
LC_NUMERIC=de_DE.UTF-8, LC_TIME=C, LC_COLLATE=de_DE.UTF-8,
LC_MONETARY=de_DE.UTF-8, LC_MESSAGES=en_US.UTF-8, LC_PAPER=en_US.UTF-8,
LC_NAME=en_US.UTF-8, LC_ADDRESS=en_US.UTF-8, LC_TELEPHONE=en_US.UTF-8,
LC_MEASUREMENT=de_DE.UTF-8, LC_IDENTIFICATION=en_US.UTF-8, with libpcap version
1.7.3, with GnuTLS 3.4.15, with Gcrypt 1.7.3, with zlib 1.2.8.
       Intel(R) Core(TM) i7-4960X CPU @ 3.60GHz (with SSE4.2)

Built using gcc 6.2.1 20160830 [gcc-6-branchrevision 239856].
--
"Decode as" on a packet isn't working for DCERPC/SPOOLSS with the Qt frontend.

Steps to reproduce:

Get the attached is an example file: wireshark_decode_as_spoolss_frame8.pcap

1. Open it with the Qt frontent
2. Select frame 8
3. right-click on frame 8
4. Select "Decode AS"
5. In the "Current" field select SPOOLSS
6. Click OK.

You will see that nothing happens. It works correctly with the GTK frontend.


You are receiving this mail because:
  • You are watching all bug changes.