Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 4200] New: Netflow dissector missing registration for total_ counts

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4200

           Summary: Netflow dissector missing registration for total_ counts
           Product: Wireshark
           Version: SVN
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: Low
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: jasondev@xxxxxxxxxxx


Build Information:
Version 1.3.2 (SVN Rev 30807 from /trunk)

Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.16.1, with GLib 2.20.1, with libpcap 1.0.0, with libz
1.2.3.3, without POSIX capabilities, without libpcre, without SMI, without
c-ares, without ADNS, without Lua, without Python, without GnuTLS, without
Gcrypt, without Kerberos, without GeoIP, without PortAudio, without AirPcap,
with new_packet_list.
NOTE: this build doesn't support the "matches" operator for Wireshark filter
syntax.

Running on Linux 2.6.28-16-generic, with libpcap version 1.0.0.

Built using gcc 4.3.3.

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
The netflow implementation has a bug where the code exists to extract four
fields from a packet, however, the decoder for these fields has not been
registered in proto_register_netflow in the hf_register_info array.  If these
fields appear in a netflow packet the following error occurs:

Warn Dissector bug, protocol CFLOW, in packet 1: proto.c:1479: failed assertion
"(guint)hfindex < gpa_hfinfo.len"

The affected fields are:

hf_cflow_drop_total_octets
hf_cflow_drop_total_octets64
hf_cflow_drop_total_packets
hf_cflow_drop_total_packets64

The fix is to include decoders for the fields in the proto_register_netflow.

I've attached a pcap that demonstrates the problem - but it needs bug 4199 to
be fixed to expose the problem.


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.