https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15036
Bug ID: 15036
Summary: Incorrect "DNS query retransmission" warning in ICMP
response
Product: Wireshark
Version: 2.6.2
Hardware: x86-64
OS: macOS 10.13
Status: UNCONFIRMED
Severity: Minor
Priority: Low
Component: Dissection engine (libwireshark)
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Created attachment 16526
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=16526&action=edit
A screenshot highlighting the incorrect warning.
Build Information:
Wireshark 2.6.2 (v2.6.2-0-g1b3cedbc)
Copyright 1998-2018 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with Qt 5.3.2, with libpcap, without POSIX capabilities, with
GLib 2.36.0, with zlib 1.2.5, with SMI 0.4.8, with c-ares 1.12.0, with Lua
5.2.4, with GnuTLS 3.4.17, with Gcrypt 1.7.7, with MIT Kerberos, with MaxMind
DB
resolver, with nghttp2 1.21.0, with LZ4, with Snappy, with libxml2 2.9.4, with
QtMultimedia, with SBC, with SpanDSP, with bcg729.
Running on Mac OS X 10.13.6, build 17G65 (Darwin 17.7.0), with Intel(R)
Core(TM)
i5-7267U CPU @ 3.10GHz (with SSE4.2), with 8192 MB of physical memory, with
locale en_GB.UTF-8, with libpcap version 1.8.1 -- Apple version 79.20.1, with
GnuTLS 3.4.17, with Gcrypt 1.7.7, with zlib 1.2.11, binary plugins supported (0
loaded).
Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build
2336.9.00).
--
I was using a network that blocked 1.1.1.1 and 8.8.8.8 and other public DNS
servers. I sent out my DNS query, but the router responded with ICMP
Destination Unreachable, "Communication administratively filtered", along with
my original DNS packet.
Wireshark has noticed that the DNS transaction IDs are the same, and is marking
it as a warning with "DNS query retransmission". But the warning is incorrect —
the second packet isn't a duplicate DNS query, it's a new packet that includes
the data from the first packet.
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <[email protected]>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:[email protected]?subject=unsubscribe
