Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 4470] New: "L2 COS Value (802.1p)" column does not always display the correct

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4470

           Summary: "L2 COS Value (802.1p)" column does not always display
                    the correct value
           Product: Wireshark
           Version: 1.2.6
          Platform: x86
        OS/Version: Mac OS X 10.5
            Status: NEW
          Severity: Normal
          Priority: Low
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: daniel.kerse@xxxxxxxxx


Created an attachment (id=4280)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=4280)
Both packets in this pcap have the same .1p, but they display differently

Build Information:
Version 1.2.6 (SVN Rev 31702)

Copyright 1998-2010 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.12.9, with GLib 2.16.3, with libpcap 0.9.5, with libz
1.2.3, without POSIX capabilities, with libpcre 7.8, with SMI 0.4.8, with
c-ares
1.5.3, with Lua 5.1, with GnuTLS 2.6.2, with Gcrypt 1.4.3, with MIT Kerberos,
without GeoIP, with PortAudio V19-devel (built Nov 14 2008), without AirPcap.

Running on Darwin 9.8.0 (MacOS 10.5.8), with libpcap version 0.9.5, GnuTLS
2.6.2, Gcrypt 1.4.3.

Built using gcc 4.0.1 (Apple Inc. build 5488).

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
To reproduce:
Edit -> Preferences -> Layout -> Columns
Add a new column with field type "L2 COS (802.1p)". Apply the change.
Open the attached pcap file.

The first packet is from a RFC2547 traffic stream and the second is from a
martini traffic stream (draft-martini-l2circuit-encap-mpls-08.txt). Every
packet in the Martini stream shows this same anomaly. Both packets in the
attached file have the same 802.1p value, but they display differently. 

For the second (i.e. Martini) packet, the dot1p value shown in the "Packet
List" area (via the newly created column) does not match the value shown in the
"Packet Details" area.

Also I notice tshark also lists the same value as the "Packet List" area in
Wireshark, however tcpdump agrees with the "Packet Details" area of Wireshark -
see below.

$ tshark -e vlan -Tfields -r dot1p-displayerror.pcap 
802.1Q Virtual LAN, PRI: 3, CFI: 0, ID: 501
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 901

PRI = 3, 0

$ tcpdump -enr dot1p-displayerror.pcap 
reading from file dot1p-displayerror.pcap, link-type EN10MB (Ethernet)
14:06:32.244786 00:90:1a:40:9d:6c > 00:90:69:d5:78:3e, ethertype 802.1Q
(0x8100), length 1524: vlan 501, p 3, ethertype MPLS unicast, MPLS (label
100288, exp 5, ttl 255)
        (label 37, exp 5, [S], ttl 255), IP, length: 1506
11:51:57.974800 00:90:1a:40:9d:6c > 00:90:69:d5:78:3e, ethertype 802.1Q
(0x8100), length 1542: vlan 501, p 3, ethertype MPLS unicast, MPLS (label
100288, exp 4, ttl 254)
        (label 57, exp 4, [S], ttl 255)

p = 3, 3

$ tcpdump -V
tcpdump version 3.9.7
libpcap version 0.9.5
Usage: tcpdump [-aAdDefKlLnNOpqRStuUvxX] [-c count] [ -C file_size ]
                [ -E algo:secret ] [ -F file ] [ -i interface ] [ -M secret ]
                [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
                [ -W filecount ] [ -y datalinktype ] [ -Z user ]
                [ expression ]

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.