Ethereal-dev: [Ethereal-dev] Possible bug in packet-arp.c (was RE: [Ethereal-users] Error to d

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Francisco Alcoba (TS/EEM)" <francisco.alcoba@xxxxxxxxxxxx>
Date: Mon, 24 Jan 2005 15:34:08 +0100
Hi,

After having a look at some traces that show a problem in the MAC-to-IP translation 

 http://www.ethereal.com/lists/ethereal-users/200501/msg00200.html

I think there is a problem in packet-arp. The problem was that ethereal wrongly
associates one IP address to a MAC that really relates to a different one. The reason is
that, previously, a different machine sends an ARP request and, in the target hardware and
IP addresses, it sets the values of the wrong addresses. In procedure dissect_arp, around
line 732, packet-arp stores this translation in the hash table using add_ether_byip for 
ARP Requests and ARP Replys. However, according to the RFC, 

	"The target hardware address is included for completeness and
	network monitoring.  It has no meaning in the request form"

I attach a patch that avoids adding the translation in that case, plus a sample capture that shows the wrong translation in frame 2 coming from the ARP request in frame 1.

Regards, 

  Francisco

Attachment: error arp.cap
Description: Binary data

Attachment: packet-arp.patch
Description: Binary data