Wireshark-bugs: [Wireshark-bugs] [Bug 2726] New: Ethernet Length field not recognized ... Tshark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Fri, 18 Jul 2008 12:27:07 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2726

           Summary: Ethernet Length field not recognized ... Tshark and
                    Wireshark
           Product: Wireshark
           Version: 1.0.2
          Platform: PC
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: High
         Component: TShark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: jose.gonzalez@xxxxxxxx


Build Information:
TShark 1.0.2

Copyright 1998-2008 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GLib 2.16.4, with libpcap 0.9.8, with libz 1.2.3.3, with POSIX
capabilities (Linux), with libpcre 7.4, without SMI, without ADNS, without Lua,
without GnuTLS, without Gcrypt, without Kerberos.

Running on Linux 2.6.24-19-generic, with libpcap version 0.9.8.

Built using gcc 4.2.3 (Ubuntu 4.2.3-2ubuntu7).

wireshark 1.0.2

Copyright 1998-2008 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.12.9, with GLib 2.16.4, with libpcap 0.9.8, with libz
1.2.3.3, with POSIX capabilities (Linux), with libpcre 7.4, without SMI,
without ADNS, without Lua, without GnuTLS, without Gcrypt, without Kerberos,
without PortAudio, without AirPcap.

Running on Linux 2.6.24-19-generic, with libpcap version 0.9.8.

Built using gcc 4.2.3 (Ubuntu 4.2.3-2ubuntu7).



--
Per the manual for wireshark-filter and
http://www.wireshark.org/docs/dfref/e/eth.html, eth.len is a field.  The length
of the Ethernet packet does not appear in wireshark's "Paket Details" section. 
If I apply eth.len as a filter in wireshark, all of the packets disappear. I
had these problems in Windows (wireshark 1.0.0) and linux (wireshark 1.0.2).
Using tshark to obtain the data from the eth.len field results in no data.

exampe command
command:  tshark -r test.pcap -T fields -E header=y -e frame.number -e ip.addr
-e eth.len


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.