Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 2347] X25 dissect checks payload and assumes IP before heuristics

[bugzilla-daemon@xxxxxxxxxxxxx]

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2347





--- Comment #8 from Gerhard Olsson <gerhard.nospam@xxxxxxxxx>  2008-03-14 13:30:21 GMT ---
Created an attachment (id=1551)
 --> (http://bugs.wireshark.org/bugzilla/attachment.cgi?id=1551)
Snoop with example testcase

X25 packet with More flag set, user data in the second packet starting with
0x45 (first with 0) so it is interpreted as IP. 

If "Reassemble X25" is not set:
Both X25 packets interpreted as IP, first with "Bogus header", second with some
garbage information...

If "Reassemble X25" is set:
A bug in the X25 reassembly code is manifesting as the packet is interpreted as
IP even if only the second packet starts with 0x45. Also, the IP packet appears
twice.
The patch handles the problem though, interpreted correctly after applying even
if the presentation is confusing. The presentation should be handled in another
bug report, I will submit if I get a grip on the problem (I rather see my bugs
with an attached solution being fixed than polluting the database).


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.