It looks as though the dissection code for the FCIP Special Frame might be off by two bytes on the last two fields, namely Destination Fabric WWN and K_A_TOV. I propose the following change to dissect_fcip_sf to take care of the problem (see comments in code for details on the changes I made):
static void dissect_fcip_sf (tvbuff_t *tvb, proto_tree *tree, gint offset) { if (tree) { proto_tree_add_string (tree, hf_fcip_src_wwn, tvb, offset, 8, fcwwn_to_str (tvb_get_ptr (tvb, offset, 8))); proto_tree_add_bytes (tree, hf_fcip_src_entity_id, tvb, offset+8, 8, tvb_get_ptr (tvb, offset+8, 8)); proto_tree_add_bytes (tree, hf_fcip_conn_nonce, tvb, offset+16, 8, tvb_get_ptr (tvb, offset+16, 8)); proto_tree_add_item (tree, hf_fcip_conn_flags, tvb, offset+24, 1, 0); proto_tree_add_item (tree, hf_fcip_conn_code, tvb, offset+26, 2, 0); // changes are below: // 'offset+30' is now 'offset+28' // 'offset+38' is now 'offset+36' proto_tree_add_string (tree, hf_fcip_dst_wwn, tvb, offset+28, 8, fcwwn_to_str (tvb_get_ptr (tvb, offset+28, 8))); proto_tree_add_item (tree, hf_fcip_katov, tvb, offset+36, 4, 0); } } Andy Homan [EMAIL PROTECTED] [EMAIL PROTECTED]