--- Begin Message ---
On 07/05/2020 15:39, Francois-Xavier Le Bail wrote:
> On 07/05/2020 09:39, Francois-Xavier Le Bail via tcpdump-workers wrote:
>>> In this *particular* case, that test is done only if the uppermost nibble
>>> of the uppermost octet is 0, so that would only be the case for the source
>>> address, which is less likely to be a group address than the destination
>>> address. There may be other places where that heuristic dissector is used,
>>> however.
>> Ok.
>> What if the first nibble is <> de 4, 6, 1, 0, e.g. 'f' like the first f of
>> ff:ff:ff:ff:ff:ff ?
>
> Currently tshark don't decode if first nibble is <> de 4, 6, 1, 0:
> (ARP request not seen, just "Data")
> ---------------------------------------------------------------------------
> MultiProtocol Label Switching Header, Label: 262145, Exp: 0, S: 1, TTL: 253
> 0100 0000 0000 0000 0001 .... .... .... = MPLS Label: 262145
> .... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0
> .... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1
> .... .... .... .... .... .... 1111 1101 = MPLS TTL: 253
> Data (64 bytes)
>
> 0000 ff ff ff ff ff ff 00 50 79 66 68 01 08 06 00 01 .......Pyfh.....
> 0010 08 00 06 04 00 01 00 50 79 66 68 01 0a 48 01 42 .......Pyfh..H.B
> 0020 ff ff ff ff ff ff 0a 48 01 43 00 00 00 00 00 00 .......H.C......
> 0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Data:
> ffffffffffff005079666801080600010800060400010050796668010a480142ffffffff<E2>
> <80><A6>
> [Length: 64]
> ---------------------------------------------------------------------------
> 1 16:26:10.061638 ca:04:2c:7e:00:08 > 00:b5:df:d1:63:02, ethertype MPLS
> unicast (0x8847),
> length 82: MPLS (label 262145, exp 0, [S], ttl 253)
> 00:50:79:66:68:01 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length
> 64: Ethernet (len 6),
> IPv4 (len 4), Request who-has 10.72.1.67 (ff:ff:ff:ff:ff:ff) tell 10.72.1.66,
> length 50
> ---------------------------------------------------------------------------
Already reported issue. Currently no fix.
(https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13306)
--
Francois-Xavier
--- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
