Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 1880] New: should provide an option to print tunnel encapsulation

[bugzilla-daemon@xxxxxxxxxxxxx]

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1880

           Summary: should provide an option to print tunnel encapsulation
           Product: Wireshark
           Version: 0.99.6
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: Major
          Priority: Low
         Component: TShark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: fpeters@xxxxxxxxxx


Build Information:

--
Forwarded from http://bugs.debian.org/244279

----
Anand Kumria:

when comparing the output of tcpdump:
wildfire@sutekh:~/ip6/tb$ sudo tcpdump -c 10 -i eth0 proto ipv6
tcpdump: listening on eth0
04:24:37.295085 sutekh.progsoc.uts.edu.au >
CPE-144-136-88-232.nsw.bigpond.net.au: sutekh-bemused-37.ip6.progsoc.uts.edu.au
> bemused-37-sutekh.ip6.progsoc.uts.edu.au: icmp6: echo request (DF)
04:24:49.868910 sutekh.progsoc.uts.edu.au > gw-ipv6.trumpet.com.au:
tunc1.tunnels.ip6.trumpet.net.3200 > tunc0.tunnels.ip6.trumpet.net.bgp: P
863833055:863833074(19) ack 4271389598 win 63900: BGP (DF)
04:24:50.215215 gw-ipv6.trumpet.com.au > sutekh.progsoc.uts.edu.au:
tunc0.tunnels.ip6.trumpet.net.bgp > tunc1.tunnels.ip6.trumpet.net.3200: . ack
19 win 15674 [class 0x60]
04:24:56.746461 sutekh.progsoc.uts.edu.au > ipv6.broadway.aarnet.net.au:
3ffe:8001:c:ffff::60.bgp > 3ffe:8001:c:ffff::61.1934: P
1480493576:1480493595(19) ack 3142910271 win 5632 <nop,nop,[|tcp]> (DF)
04:24:56.748935 ipv6.broadway.aarnet.net.au > sutekh.progsoc.uts.edu.au:
3ffe:8001:c:ffff::61.1934 > 3ffe:8001:c:ffff::60.bgp: . ack 19 win 6432
<nop,nop,[|tcp]> [hlim 1] (DF)
04:24:56.806880 ipv6.broadway.aarnet.net.au > sutekh.progsoc.uts.edu.au:
3ffe:8001:c:ffff::61.1934 > 3ffe:8001:c:ffff::60.bgp: P 1:20(19) ack 19 win
6432 <nop,nop,[|tcp]> [hlim 1] (DF)
04:24:56.807077 sutekh.progsoc.uts.edu.au > ipv6.broadway.aarnet.net.au:
3ffe:8001:c:ffff::60.bgp > 3ffe:8001:c:ffff::61.1934: . ack 20 win 5632
<nop,nop,[|tcp]> (DF)
04:24:57.093743 gw-ipv6.trumpet.com.au > sutekh.progsoc.uts.edu.au:
2001:738:2001:4032:200:f8ff:fe09:a82f.32769 > orgo.progsoc.uts.edu.au.domain: 
15993 [1au][|domain]
04:24:57.096810 sutekh.progsoc.uts.edu.au > gw-ipv6.trumpet.com.au:
orgo.progsoc.uts.edu.au.domain > 2001:738:2001:4032:200:f8ff:fe09:a82f.32769: 
15993*[|domain] (DF)
04:24:57.662455 gw-ipv6.trumpet.com.au > sutekh.progsoc.uts.edu.au:
2001:738:2001:4030:2c0:dff:fe00:4153 > sutekh.progsoc.uts.edu.au: icmp6: echo
request
53 packets received by filter
0 packets dropped by kernel

versus that of tethereal:
wildfire@sutekh:~/ip6/tb$ sudo tethereal -c 10 -i eth0 proto ipv6
Capturing on eth0
  0.000000 3ffe:8001:c:6:250:baff:fe61:782a -> 2001:960:9:1:0:1:53:1 DNS
Standard query TXT 10.10.166.82.ipwhois.rfc-ignorant.org
  0.108929 3ffe:8001:c:6:250:baff:fe61:782a -> 2001:6c8:6:1::3 DNS Standard
query TXT 10.10.166.82.list.dsbl.org
  0.505647 2001:960:9:1:0:1:53:1 -> 3ffe:8001:c:6:250:baff:fe61:782a DNS
Standard query response, No such name
  0.575610 2001:6c8:6:1::3 -> 3ffe:8001:c:6:250:baff:fe61:782a DNS Standard
query response TXT
  9.044702 3ffe:8001:c:ffff::71 -> 3ffe:8001:c:ffff::72 ICMPv6 Echo request
 18.618390 3ffe:8000:ffff:100c::101 -> 3ffe:8000:ffff:100c::100 BGP KEEPALIVE
Message
 18.965306 3ffe:8000:ffff:100c::100 -> 3ffe:8000:ffff:100c::101 TCP bgp > 3200
[ACK] Seq=0 Ack=19 Win=15655 Len=0
 23.480156 3ffe:8001:c:6:250:baff:fe61:782a -> 2001:960:9:1:0:1:53:1 DNS
Standard query TXT 30.133.101.150.ipwhois.rfc-ignorant.org
 23.498084 3ffe:8001:c:6:250:baff:fe61:782a -> 2001:960:9:1:0:1:53:1 DNS
Standard query TXT 181.214.16.203.ipwhois.rfc-ignorant.org
 23.665995 3ffe:8001:c:6:250:baff:fe61:782a -> 2001:6c8:6:1::3 DNS Standard
query TXT 30.133.101.150.list.dsbl.org


tcpdump has one thing over tethereal: it prints out the IPv4 IP
encapsulation (I've using tunnel for my IPv6 connections). It'd be great
if tethereal had the same option.

I can imagine this being useful for GRE/IPv4 in IPv6 tunnel/IPv6 in IPv6
tunnels, etc.


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.