Wireshark-users: Re: [Wireshark-users] ipv6 unknown extension header
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Martin d Anjou <point14@xxxxxxxx>
Date: Thu, 6 Nov 2008 22:32:40 -0500 (EST)
Is wireshark able to "jump" over the unknwon extension header (using the Hdr Ext Len) and keep searching for next headers and eventually find L4 protocols like TCP? 
No - is anything *else* able to do so?

[explanation deleted]

This doesn't seem to suggest that skipping over unknown headers is
necessarily the right thing to do.

I agree with your conclusion. An "unknown" ipv6 extension header could be 
a new layer 4 protocol, or a new ipv6 extension header whose second byte 
is not the Hdr Ext Len, which makes "jumping over it" the wrong thing to 
do.

And like you, I don't see any "correct" thing to do with unknown ipv6 
extension header, so it does not seem like Sake Blok's "fix" is the right 
thing to do either:

I committed a patch in SVN 26722 that fixes this issue...

Sorry Sake... Although I can probably use your commit to patch my local 
copy for the time being, so thanks a lot for that!

Now, any advice for me? Write a dissector for my "unknown" extension 
header therefore making it a known one? I am just trying to put out an 
extension header whose length I can control easily, but the content does 
not matter.

Thanks,
Martin