Are those ports assigned to LLC? http://www.iana.org/assignments/port-numbers
says: > entextxid 12000/tcp IBM Enterprise Extender SNA XID Exchange > entextxid 12000/udp IBM Enterprise Extender SNA XID Exchange > entextnetwk 12001/tcp IBM Enterprise Extender SNA COS Network Priority > entextnetwk 12001/udp IBM Enterprise Extender SNA COS Network Priority > entexthigh 12002/tcp IBM Enterprise Extender SNA COS High Priority > entexthigh 12002/udp IBM Enterprise Extender SNA COS High Priority > entextmed 12003/tcp IBM Enterprise Extender SNA COS Medium Priority > entextmed 12003/udp IBM Enterprise Extender SNA COS Medium Priority > entextlow 12004/tcp IBM Enterprise Extender SNA COS Low Priority > entextlow 12004/udp IBM Enterprise Extender SNA COS Low Priority Anyway, the problem is Martin's traffic is running on the ports the LLC dissector expects to find LLC traffic on. It would be good if the LLC dissector could be made a "new style" dissector that attempts some heuristics on the payload and doesn't dissect anything if it thinks the traffic doesn't belong to it. I'm not sure if that's possible, though. Martin, another workaround (besides changing ports) would be to disable the LLC dissector. Jaap Keuter wrote: > Hi, > > According to RFC 2353 this decoding is correct. See paragraph 2.6.1. > These UDP/TCP ports are assigned by IANA to this protocol. It is > implemented as such in the LLC dissector. > > Thanx, > Jaap > > On Tue, 30 Jan 2007, Martin Pokorny wrote: > >> Hi, >> >> I think I may have stumbled onto a wireshark bug (ethereal version >> 0.99.0, libpcap version 0.8.3 on RHEL4). An application on which I'm >> working is receiving UDP packets over gigabit Ethernet from some custom >> hardware. The packets have a fixed source and destination UDP port >> number, which we had set to 12001 and 12000, respectively. Wireshark >> shows an LLC header after the UDP header, which is simply not present; >> see first attachment (bad.pcap). In the process of poking around a bit, >> I changed the UDP port numbers to 12032 and 12048 in the pcap file, and >> wireshark no longer reported the LLC header; see second attachment >> (good.pcap). Unless I'm totally missing something about LLC (definite >> possibility), this looks like a bug in wireshark or libpcap. >> >> I'm not subscribed to this list, please send questions to me directly. >> >> -- >> Martin >> > > _______________________________________________ > Wireshark-users mailing list > [email protected] > http://www.wireshark.org/mailman/listinfo/wireshark-users > > _______________________________________________ Wireshark-users mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-users
