Wireshark-users: Re: [Wireshark-users] [Wireshark-dev] RTCP Frame length check: Wrong
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 10 Apr 2009 21:17:31 -0700

On Apr 10, 2009, at 11:56 AM, Guy Harris wrote:


Packet 63 in the capture you sent, which only dissect as RTCP in my
version of Wireshark if you explicitly use "Decode As" - even the
heuristics aren't recognizing it as RTCP.


I'll see whether the heuristics can be changed.


The problem appears to be a bug in the RTCP dissector - for padded
packets, it's counting the padding bytes, but not the padding count
byte, as part of the packet, so it thinks there's one byte missing.
I'll look at fixing the bug.
I've checked in a fix for that; it's in the main SVN branch, and I've proposed it for the 1.0.8 release.