Hi,
Looking at a fuzzed pcap with many errors I started to wonder if we should abort
dissection of obviously broken packets. Like in this IP packet where the packet
length is bogus. But captured and frame lengths are OK,
Frame Length: 150 bytes (1200 bits)
Capture Length: 150 bytes (1200 bits)
Maybe stop after IP layer?
Internet Protocol Version 4, Src: 255.119.127.0, Dst: 16.69.144.0
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length: 883
[Expert Info (Error/Protocol): IPv4 total length exceeds packet length (136 bytes)]
[IPv4 total length exceeds packet length (136 bytes)]
[Severity level: Error]
[Group: Protocol]
Identification: 0x0000 (0)
000. .... = Flags: 0x0
...0 0000 0000 0000 = Fragment Offset: 0
Time to Live: 25
Protocol: GRE (47)
Header Checksum: 0xffff [validation disabled]
[Header checksum status: Unverified]
Source Address: 255.119.127.0
Destination Address: 16.69.144.0
[Stream index: 2462]
Best regards
Anders