Wireshark-bugs: [Wireshark-bugs] [Bug 12568] Wireshark is marking BGP FlowSpec NLRI as malformed
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 30 Jun 2016 10:21:11 +0000

Comment # 26 on bug 12568 from 
(In reply to Matt Texier from comment #25)
> Difficult to have 513 bytes fitting into 243 bytes :) !
> 
> It is probably to early to jump to conclusion but there is chance that this
> packet is malformed ...

Your conclusion is right. Packet #2 indeed is a corrupt packet (mentioned
earlier -> we opened a ticket with cisco :-) ). 

Only Packet #1 is a correct (packet #3 is the notification packet sent in
response to the malformed #2) update from Cisco.

I verified Packet #1 again and think it is really correct. I am not familiar
with the way dissectors work, however may the problem that we see with packet
#1 result from the fact that the return value of decode_flowspec_nlri should be
tot_flow_len + offset_len (the total number of dissected bytes, or at least
somehow account for the additional byte of length field?)? 

Cheers Stoffi

You are receiving this mail because:
  • You are watching all bug changes.