Wireshark-bugs: [Wireshark-bugs] [Bug 8362] Checksum calculation is wrong for some IPv6 packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 21 Feb 2013 06:59:27 +0000

Comment # 3 on bug 8362 from 
That's not a wrong checksum calculation, that's wrong use of the Fragment EH.
This repeated use of the Fragment EH (M=0) tricks Wireshark into believing the
packet is complete and it sets out processing the rest of the data as if it
were complete. In this specific case the ICMPv6 dissector calculates the
checksum over what it believes is a complete packet. 

What Wireshark should do is only allow dissection of EH's after a Fragment EH
with M-bit set, but no payload. It could even flag repeated use of Fragment EH
as noteworthy event, possible protocol attack.

You are receiving this mail because:
  • You are watching all bug changes.