Wireshark-bugs: [Wireshark-bugs] [Bug 11451] GOOSE pdu (BER payload) is marked as 3 bytes shorte
Comment # 3
on bug 11451
from Pascal Quantin
(In reply to Bogdan Stanca-Kaposta from comment #2)
> As you already mentioned, the ASN.1 BER decoding is correct, just the
> highlighting of the "goosePDU" node (under GOOSE) is 3 bytes shorter
>
> The mentioned Option (Edit -> Preferences -> Protocol -> BER -> show
> internal BER encapsulation tokens) does not change the highlighted region:
> reproduced with the sequence below.
>
> How to reproduce:
> 1) Load the PCAP from the example at
> https://wiki.wireshark.org/
> SampleCaptures?action=""
> 2) click on the first (GOOSE) packet and expand the tree
> 3) select GOOSE/Reserved2 Node (bytes 00 00)
> 4) select GOOSE/goosePDU Node (bytes 80 1a ....)
>
> Between the bytes 00 00(Reserved2) and the highlighted goosePDU bytes there
> are 0x61 0x81 0x86 which also show be shown as part of the goosePDU.
>
> Please specify which extra information do you need in order to reproduce the
> issue?
I was probably not clear in comment #1, sorry about that.
I meant that, by activating the BER option, we can see that the 3 bytes are the
BER Tag and Length encoding that is *before* the goosePdu bitstream itself
(which is the Value part of the BER TLV) that starts at the position
highlighted in the byte pane.
Personally I do not consider this as a bug from a BER encoding point of view:
it's just that with the default view you have fields that are hidden (the BER
ones).
I will let other developers comment if they do not share my point of view.
You are receiving this mail because:
- You are watching all bug changes.
