Wireshark-bugs: [Wireshark-bugs] [Bug 11271] Dissecting engine stops after MPLS shims
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sat, 13 Jun 2015 13:40:19 +0000

changed bug 11271


What Removed Added
Status CONFIRMED IN_PROGRESS

Comment # 4 on bug 11271 from 
(In reply to Jasper Bongertz from comment #3)
> So if I understand this correctly the code was changed, requiring me to do a
> manual "decode as" to be able to decode Ethernet based MPLS payloads? 
> 
> My recommendation would be to check the MPLS payload for IP version nibbles
> "4" or "6" being present at payload offset 0 to check if it is IP based
> payload (I think this is what Wireshark does right now). 
> 
> If there isn't, check if the 16 bit value starting at payload offset 12
> (skipping 2x 6 byte MAC addresses) is 0x800, 0x806, 0x8035, 0x8100 or 0x86dd
> (IPv4, ARP, RARP, VLAN, IPv6). If so, it's Ethernet over MPLS. There may be
> other Ethertypes, but frankly, those are the ones where it makes sense to
> decode the layer automatically; everything else can be "decoded as". That's
> actually what I do not in TraceWrangler and it works fine so far.

OK thanks for the suggestion, I'm amending the patch accordingly.

You are receiving this mail because:
  • You are watching all bug changes.