Wireshark-bugs: [Wireshark-bugs] [Bug 5010] colorisation error: TTL 255 for multicast packets is
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 15 Jul 2010 05:15:02 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5010

--- Comment #3 from Frank Heydlauf <fh2010ws@xxxxxxxxxxx> 2010-07-15 05:15:00 PDT ---
(In reply to comment #2)
> ( ! ip.dst == 224.0.0.0/4 && ip.ttl < 5 && !pim) ||
> (ip.dst == 224.0.0.0/24 && ip.ttl != 1 && !vrrp)
> 
> works for me.

aeh - sorry. The scope of the expression above is to big!

VRRP is expected to have TTL 255 and 
"TTL low or unexpected" is expected to show every other TTL!
So you'd better use 

( ! ip.dst == 224.0.0.0/4 && ip.ttl < 5 && !pim) ||
(ip.dst == 224.0.0.0/24 && ip.ttl != 1) ||
(vrrp && ip.ttl < 255 ) ||
(ip.dst == 224.0.0.251 && ip.ttl < 255 )

# yes, could be shorter - but is easier to read this way...)

-- 
Greets
Frank

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.