Wireshark-users: Re: [Wireshark-users] a little bug（maybe not a bug，m3ua padding treated as malfo
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 06 Aug 2010 13:58:58 -0400
damker wrote:

Hi experts：
      Attachment is a normal IP packet，the last "00 00 00" is m3ua padding, but treated as malformed packet.


I think the packet is malformed.
If you disable the BSSMAP dissector, the M3UA padding will correctly be displayed. (It doesn't in this case because BSSMAP is throwing an exception.)
The last octet in the BSSMAP portion indicates that "T-GSM 400 Band Information present" is true which means there should be another couple of octets of (400-Band) info, but it's not there (thus leading to the exception/malformed indication).