https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15258
Pascal Quantin <pascal.quan...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|INCOMPLETE |CONFIRMED
--- Comment #7 from Pascal Quantin <pascal.quan...@gmail.com> ---
(In reply to ttttabcd from comment #3)
> Created attachment 16692 [details]
> ntpdc mode 7 capture packet example
>
> This is an example of a monlist request with two versions, MON_GETLIST_1 and
> MON_GETLIST
>
> As you can see in this example, |R|M| VN | Mode| Fields and | A | Sequence
> | Fields are resolved to the same byte in wireshark
I agree, but none of the packets in this capture have the A bit set, so it does
not help testing the decoding of the Encryption Keyid and MAC
>
> As you can see in the No. 2 package, the IPv6 address will be parsed
> incorrectly. In fact, the remote address is fe80::da50:e6ff:fe4f:2982, and
> the local address is fe80::2ac2:ddff:fe84:3041
Which is not related to the A bit, it simply shows that mode 7 parsing for
MON_GETLIST_1 is wrongly implemented
>
> In the No.5 package, you can see that the returned message requested by
> MON_GETLIST is not correctly parsed, but the packet format is actually
> correct by manual analysis.
MON_GETLIST is not incorrectly parsed, it's not parsed at all as only
MON_GETLIST_1 is implemented.
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
