This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark Import Hex Dump always strip last byte of the packet

0

I am trying to import below ICMP6 destination unreachable packet in hex dump into Wireshark but it keeps stripping last byte (34) here and then indicate checksum is invalid. I tried remove '34' and re-import again, in that case '4e' would be stripped instead...

This is a Raw IPv6 packet and I imported it with below setting: Offsets: hexadecimal Encapsulation type: Raw IPv6

I tried import an ICMPv4 destination unreachable packet and it worked fine.

I am wondering if I am missing something here ? Any idea is well appreciated! thanks!

0000 60 00 00 00 00 24 3a 7c 00 00 00 00 00 00 00 00
0010 00 c0 00 00 02 00 00 00 20 01 0d b8 00 01 ff ff
0020 00 00 00 00 0a 2a 7b 64 01 04 28 9d 00 00 00 00
0030 45 00 00 56 00 43 00 00 ff 11 3b 50 c0 00 00 01
0040 c0 00 00 02 00 35 d1 4c 00 42 4e 34

asked 15 Jan '15, 15:02

Gallon's gravatar image

Gallon
16557
accept rate: 0%

edited 15 Jan '15, 15:04

What version of wireshark do you use? It sounds like an old bug

(15 Jan '15, 21:33) Anders ♦

...and if it's an old bug, there's no reason to submit it on the Wireshark Bugzilla.

(15 Jan '15, 23:35) Guy Harris ♦♦

I can't reproduce this with the version of Wireshark on the tip of the main branch, so this might be an old bug.

(15 Jan '15, 23:38) Guy Harris ♦♦

(By the way, why does an ICMPv6 Destination Unreachable packet have an IPv4 packet as the packet sent to the unreachable destination?)

(15 Jan '15, 23:39) Guy Harris ♦♦

One Answer:

0

This function is derived from text2pcap, and

Text2pcap understands a hexdump of the form generated by od -Ax -tx1 -v. In other words, each byte is individually displayed and surrounded with a space.

It that 'surrounded with a space' that's tripping you up. Add a trailing space and you should be fine.

answered 16 Jan '15, 07:12

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

thanks. That helps!

(16 Jan '15, 09:41) Gallon

As indicated, the trunk's "import from a text file" doesn't require the trailing space; the trunk's text2pcap doesn't, either. The requirement for a trailing space was a bug, and was apparently fixed at some point. I've updated the text2pcap man page to reflect that.

(16 Jan '15, 10:42) Guy Harris ♦♦