Wireshark-dev: [Wireshark-dev] IPv6 Fragment header on reassembled frame
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: ivan jr sy <ivan_jr@xxxxxxxxx>
Date: Sat, 22 Aug 2009 12:08:59 -0700 (PDT)
To wireshark devs:

Im trying to investigate if IPv6 fragmentation offset should be interpreted as 13-bit int? or a 16-bit?

see section 4.5 of RFC 2460

packet-ipv6.h
#define IP6F_OFF_MASK		0xfff8	/* mask out offset from _offlg */

packet-ipv6.c
    { &hf_ipv6_frag_offset,
    { "Offset",		"ipv6.fragment.offset",
	FT_UINT16, BASE_DEC_HEX, NULL, IP6F_OFF_MASK,
        "Fragment Offset", HFILL }},

However it is conflicting with the fragment's reassemble information.

Steps:

1. view frame#4 of the attached capture
2. notice under the IPv6 Fragments  subtree, 
    [IPv6 Fragments (5008 bytes): #1(1448), #2(1448), #3(1448), #4(664)]
        [Frame: 1, payload: 0-1447 (1448 bytes)]
        [Frame: 2, payload: 1448-2895 (1448 bytes)]
        [Frame: 3, payload: 2896-4343 (1448 bytes)]
        [Frame: 4, payload: 4344-5007 (664 bytes)]
3. go to frame#3 under Fragmentation Header subtree
notice that the offset is 
        0001 0000 1111 1... = Offset: 543 (0x021f)
should'nt this be?
2896?
the fix is to change hf_ipv6_frag_offset IP6_OFF_MASK to 0x0 (not ipv6.h)

Thanks!

Attachment: ipv6-fragment-header.cap
Description: application/cap