Wireshark-bugs: [Wireshark-bugs] [Bug 12548] Add support for defragmentation of PPP Multilink (R
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 21 Jun 2016 23:16:17 +0000

Comment # 3 on bug 12548 from 
Created attachment 14675 [details]
Selected zeroed payload.

Here's a sample capture where everything in the reassembled payload past the
IP/UDP headers is zeroed out. (This messes up checksums, and also there's some
SCTP headers with bad checksums or malformed packets as well, but the basic
idea works.) That should be enough for reassembly.

This shows a few of the pathologies from sequence wraparound, including on
different classes. This capture actually aggregates several PPP MP bundles in a
single interface (it came from a larger SDH or PDH capture) so it's a little
crazy even without classes. Compare packets around 4127 and 32366, around 15783
and 57391, and 47566 and 64890.

The correct packets are (I think all) received in order in this capture.
Additional pathologies can be created by rearranging the packets through some
more editcap/mergecap work, which I did as part of my testing. Some of the
checks that handle that situation in the patch are unnecessary for this
relatively in order capture. I don't think that this subset has anything
fragmented into six fragments, though I do have examples from a larger capture.

You are receiving this mail because:
  • You are watching all bug changes.