Wireshark-bugs: [Wireshark-bugs] [Bug 10300] ERF/Ethernet-related bug where a FCS is not present
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 23 Jul 2014 15:48:03 +0000

Comment # 3 on bug 10300 from 
Agreed. The file appears to be pcap format, with DLT_ERF. The ERF_TYPE_ETH
format is expected to include a 4-byte FCS, so by default the ERF Protocol
Preference "Ethernet Packets have FCS" is on.

You can switch this preference off when viewing the file as a work-around. This
allows for files containing ERF_TYPE_ETH which do not have an FCS.

I wouldn't consider this a bug in the ERF dissector, although you could argue
about whether a heuristic would be useful.

Do you know how the file was created? Was it a direct capture, or converted
from another format? We may want to follow that up and see if some capture or
conversion tool should be modified to add a FCS for ERF.

You are receiving this mail because:
  • You are watching all bug changes.