[chuck c <bubbasnmp@xxxxxxxxx>]

lwres: Do not claim (unregistered) port 921

https://gitlab.com/wireshark/wireshark/-/merge_requests/23056

Wireshark sometimes assumes the lower (smaller) port number in a conversation is the server.

The change above should fix that for lwres but there may be other source ports lower than 4789 that will show the same behavior.

On Sun, Jan 11, 2026 at 12:09 AM kundan kumar <kundank3069@xxxxxxxxx> wrote:

Hello Wireshark Dev Team,

I am sending valid VXLAN packets with UDP destination port 4789. When the UDP source port is an ephemeral (high-numbered) port, Wireshark decodes the packets correctly as VXLAN. However, when the UDP source port is 921 and the destination port is still 4789, the same packets are decoded as LWRES instead of VXLAN. Could you please help explain why this behavior occurs?

Thanks,
Kundan

_______________________________________________
Wireshark-dev mailing list -- wireshark-dev@xxxxxxxxxxxxx
To unsubscribe send an email to wireshark-dev-leave@xxxxxxxxxxxxx