Hi, Wireshark complains about bogus udp length when processing last fragment of UDP data. It compares length field from UDP header with payload size of last fragment.
Attached is my attempt to fix this by referring to tvp->length instead of pinfo->iplen - pinfo->iphdrlen. Not entirely sure if it is the best way, but appears to work for me. Attached is also sample capture file. With reference to my earlier message, do not worry about output above UDP layer. http://www.wireshark.org/lists/wireshark-dev/200701/msg00265.html Regards Andrej
wccpfrag.pcap
Description: Binary data
udplen.gz
Description: application/gunzip
_______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
