This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

erspan packets malformed

0

When viewing erspan packets in wireshark, I get malformed packets. The packet are good, but wireshark is not interpreting the packet correct.

Packet is formed : EtherII - ip - gre - erspan - etherII - IP - ipdata The first etherII has a trailer of 32 bytes, which is odd the ip headers have the correct 'total length', taking into account the extra 32 bytes of the (etherII-ip-gre-erspan) headers the last ip header shows the correct length, the same as the original packet before encapsulation.

ex an ICMP packet: the ipdata portion of the original ip packet 80 bytes total length with 20bytes header, leaving 60 bytes for the icmp packet. Icmp has an 8 byte header, leaving 52 bytes of data, but wireshark reports 20 bytes, which is 32 bytes too short

I guess this is a bug in wireshark parsing, put I'm not sure how to report it

Pieter

asked 25 Jun '14, 07:02

PieterL's gravatar image

PieterL
11112
accept rate: 0%


One Answer:

2

Second entry from Google search of "wireshark bugs", on the wiki: Reporting Bugs.

answered 25 Jun '14, 08:35

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Link to the bugreport https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10230 It is not a Wireshark bug, but a Cisco bug.

(08 Dec '14, 14:23) PieterL