Wireshark-bugs: [Wireshark-bugs] [Bug 1125] Not decoding SNMP trap agent address if data length
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 11 Oct 2006 03:31:05 +0000 (GMT)
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1125





------- Comment #4 from ronniesahlberg@xxxxxxxxx  2006-10-11 03:31 GMT -------
This is not a bug.   This is correct behaviour by wireshark.

The packet in the screenshot is a field that is defined as
(rfc1155) as
                  NetworkAddress ::=
                      CHOICE {
                          internet
                              IpAddress
                      }


                  IpAddress ::=
                      [APPLICATION 0]          -- in network-byte order
                          IMPLICIT OCTET STRING (SIZE (4))

I.e.  this field MUST always be exactly 4 bytes in size.


The host that generated this packet is violating the SNMP protocol definition
and sends corrupt and invalid packets.
The packet is corrupted and this is correctly handleded and indicated by
wireshark.

I am certain that the vendor is interested in addressing this bug in their
software so that their traps become compliant with the standard.


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.