Wireshark-dev: [Wireshark-dev] [PATCH] Bogus length reported for reassembled UDP packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Andrej Mikus <wireshark-dev@xxxxxxxx>
Date: Wed, 31 Jan 2007 20:06:45 +0100
Hi,

Wireshark complains about bogus udp length when processing last fragment
of UDP data. It compares length field from UDP header with payload size
of last fragment.

Attached is my attempt to fix this by referring to tvp->length instead
of pinfo->iplen - pinfo->iphdrlen. Not entirely sure if it is the best
way, but appears to work for me.

Attached is also sample capture file. With reference to my earlier
message, do not worry about output above UDP layer.
http://www.wireshark.org/lists/wireshark-dev/200701/msg00265.html

Regards
Andrej

Attachment: wccpfrag.pcap
Description: Binary data

Attachment: udplen.gz
Description: application/gunzip