Wireshark-bugs: [Wireshark-bugs] [Bug 5645] New: Ethernet packets with both VLAN tag and LLC hea
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 1 Feb 2011 15:04:23 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5645

           Summary: Ethernet packets with both VLAN tag and LLC header no
                    longer displayed correctly
           Product: Wireshark
           Version: 1.5.x (Experimental)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Minor
          Priority: Low
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: bej@xxxxxxxxx


Created an attachment (id=5853)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5853)
Ethernet 802.3 packets with tag headers

Build Information:
Version 1.5.0 (SVN Rev 35637 from /trunk)

Copyright 1998-2011 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (32-bit) with GTK+ 2.16.6, with GLib 2.24.2, with WinPcap (version
unknown), with libz 1.2.3, without POSIX capabilities, without libpcre, with
SMI
0.4.8, with c-ares 1.7.1, with Lua 5.1, without Python, with GnuTLS 2.8.5, with
Gcrypt 1.4.5, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built
Jan
24 2011), with AirPcap.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1.2
(packet.dll version 4.1.0.2001), based on libpcap version 1.0 branch 1_0_rel0b
(20091008), GnuTLS 2.8.5, Gcrypt 1.4.5, without AirPcap.

Built using Microsoft Visual C++ 9.0 build 30729

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
Captured packets containing both a VLAN (802.1Q) tag header and LLC/SNAP
headers are not formatted correctly with 1.5.0. The Ethernet II dissector is
used and displays the VLAN tag header but then formats the length field as an
unknown type and the remainder of the frame as raw data. For example, here's an
ARP packet:

Frame 1: 64 bytes on wire (512 bits), 64 bytes captured (512 bits)
Ethernet II (VLAN tagged), Src: Ibm_65:96:ac (00:09:6b:65:96:ac), Dst:
Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: Ibm_65:96:ac (00:09:6b:65:96:ac)
    VLAN tag: VLAN=2, Priority=Best Effort (default)
    Type: Unknown (0x0024)
Data (46 bytes)

0000  aa aa 03 00 00 00 08 06 00 06 08 00 06 04 00 01   ................
0010  00 09 6b 65 96 ac c0 a8 1f de 00 00 00 00 00 00   ..ke............
0020  c0 a8 1f 21 00 00 00 00 00 00 00 00 00 00         ...!..........

I'm attaching a packet capture file (tagged.pcap) that shows this. With
Wireshark 1.4.3, the packets in the same capture file are displayed OK.

I did see in the announce for 1.5.0 that the VLAN tag is now displayed by the
Ethernet II dissector, so maybe the same is still a work-in-progress for the
IEEE 802.3 dissector? Otherwise, I just wanted to make someone aware of this
just in case...

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.