Wireshark-bugs: [Wireshark-bugs] [Bug 11278] New: Port Control Protocol packet dissection decode
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 15 Jun 2015 11:17:45 +0000
Bug ID 11278
Summary Port Control Protocol packet dissection decodes R bit incorrectly
Product Wireshark
Version 1.12.5
Hardware x86
OS Windows 7
Status UNCONFIRMED
Severity Minor
Priority Low
Component Dissection engine (libwireshark)
Assignee bugzilla-admin@wireshark.org
Reporter tnobes@broadcom.com 

Created attachment 13667 [details]
capture showing the issue.

Build Information:
Version 1.12.5 (v1.12.5-0-g5819e5b from master-1.12)

Copyright 1998-2015 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.23, with Cairo 1.10.2, with Pango 1.34.0, with
GLib 2.38.0, with WinPcap (4_1_3), with libz 1.2.5, with SMI 0.4.8, with c-ares
1.9.1, with Lua 5.2, without Python, with GnuTLS 3.2.15, with Gcrypt 1.6.2,
without Kerberos, with GeoIP, with PortAudio V19-devel (built May 12 2015),
with
AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with WinPcap version
4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch
1_0_rel0b (20091008), GnuTLS 3.2.15, Gcrypt 1.6.2, without AirPcap.
Intel(R) Core(TM) i7-4600U CPU @ 2.10GHz, with 8097MB of physical memory.


Built using Microsoft Visual C++ 10.0 build 40219

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
Request / Response is encoded in PCP in bit 8 of the packet. Currently the
decode logic for this seems to be the wrong way round, showing for the request: 
0... .... = R: Response
And for the response: 
1... .... = R: Request

RFC6887 dictates:
7.1.  Request Header
:
   R: Indicates Request (0) or Response (1).
and
7.2.  Response Header
:
   R: Indicates Request (0) or Response (1).  All Responses MUST use 1.
      This is set by the server.

I've attached an example capture. Note the Map Request is shown as "Response",
and the Map Response is shown as "Request"

You are receiving this mail because:
  • You are watching all bug changes.