Wireshark · Ethereal-dev: Re: [Ethereal-dev] Problem in Ethereal with parsing of VJ-Compressed PPP packets

[Guy Harris <gharris@xxxxxxxxx>]

Vitaly Kruglikov wrote:

> Another observation that I made is that for those packets with "PPP VJ 
> Compression: Compressed data", Ethereal appears to be *over-reporting*
> the size of the TCP payload by exactly 2 bytes.

There's nothing in many captures to indicate how many bytes of FCS are 
being used with PPP; it could be using no FCS, a 2-byte FCS, or a 4-byte 
FCS.  (And even if the initial negotiation to choose an FCS size is in 
the capture, Ethereal doesn't currently handle it.)

Ethereal defaults to "no FCS"; you'd have to set the "PPP Frame Checksum 
Type" preference for PPP to "16-bit" to have it dissect the last 2 bytes 
of a PPP frame as an FCS.

If you do so, the over-reporting goes away - and the TCP checksums are 
reported as correct again, as those 2 bytes are treated as an FCS rather 
than as part of the TCP payload.

> Also, note that most of the packets coming from the phone (with "PPP VJ 
> Compression: Compressed data" and source=10.120.26.127) should just be
> ACK or Selective ACK packets, however Ethereal reports all of them as 
> having a 2-byte TCP payload.

That's the same thing - the size of the TCP payload is being 
over-reported by 2 bytes (i.e., as 2, not 0).