https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5645
Summary: Ethernet packets with both VLAN tag and LLC header no longer displayed correctly Product: Wireshark Version: 1.5.x (Experimental) Platform: All OS/Version: All Status: NEW Severity: Minor Priority: Low Component: Wireshark AssignedTo: wireshark-bugs@wireshark.org ReportedBy: b...@arbin.net Created an attachment (id=5853) --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5853) Ethernet 802.3 packets with tag headers Build Information: Version 1.5.0 (SVN Rev 35637 from /trunk) Copyright 1998-2011 Gerald Combs <ger...@wireshark.org> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compiled (32-bit) with GTK+ 2.16.6, with GLib 2.24.2, with WinPcap (version unknown), with libz 1.2.3, without POSIX capabilities, without libpcre, with SMI 0.4.8, with c-ares 1.7.1, with Lua 5.1, without Python, with GnuTLS 2.8.5, with Gcrypt 1.4.5, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built Jan 24 2011), with AirPcap. Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1.2 (packet.dll version 4.1.0.2001), based on libpcap version 1.0 branch 1_0_rel0b (20091008), GnuTLS 2.8.5, Gcrypt 1.4.5, without AirPcap. Built using Microsoft Visual C++ 9.0 build 30729 Wireshark is Open Source Software released under the GNU General Public License. Check the man page and http://www.wireshark.org for more information. -- Captured packets containing both a VLAN (802.1Q) tag header and LLC/SNAP headers are not formatted correctly with 1.5.0. The Ethernet II dissector is used and displays the VLAN tag header but then formats the length field as an unknown type and the remainder of the frame as raw data. For example, here's an ARP packet: Frame 1: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) Ethernet II (VLAN tagged), Src: Ibm_65:96:ac (00:09:6b:65:96:ac), Dst: Broadcast (ff:ff:ff:ff:ff:ff) Destination: Broadcast (ff:ff:ff:ff:ff:ff) Source: Ibm_65:96:ac (00:09:6b:65:96:ac) VLAN tag: VLAN=2, Priority=Best Effort (default) Type: Unknown (0x0024) Data (46 bytes) 0000 aa aa 03 00 00 00 08 06 00 06 08 00 06 04 00 01 ................ 0010 00 09 6b 65 96 ac c0 a8 1f de 00 00 00 00 00 00 ..ke............ 0020 c0 a8 1f 21 00 00 00 00 00 00 00 00 00 00 ...!.......... I'm attaching a packet capture file (tagged.pcap) that shows this. With Wireshark 1.4.3, the packets in the same capture file are displayed OK. I did see in the announce for 1.5.0 that the VLAN tag is now displayed by the Ethernet II dissector, so maybe the same is still a work-in-progress for the IEEE 802.3 dissector? Otherwise, I just wanted to make someone aware of this just in case... -- Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug. ___________________________________________________________________________ Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org> Archives: http://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe