This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I've correctly created a Bluetooth Low Energy advertising packet using the GAP Service Data type (0x16). Unfortunately, Wireshark is showing this as a Malformed Packet. If I switch the data type to some other type of format (say Manufacturing Specific), the dissector works fine. But when I select the Service Data type (BLE Supplement specification V6-2, page 19 - section 1.11 Service Data) it clearly states that the Service Data format (16 bit) contains two octets followed by additional service data.

From Additional debugging the problem of malformed packets seems to be that the dissector is requiring data to be in even octets - which is not a requirement of the specification. If I adjust the data enclosed within this field - wireshark does not produce a failure.

asked 01 Mar '16, 11:16

DanielLSS's gravatar image

DanielLSS
6112
accept rate: 0%

If you are sure it is a bug, Wireshark bugzilla is the right place to report it, not a Q&A site.

(01 Mar '16, 12:20) sindy

It seems to be fixed in: https://code.wireshark.org/review/6902 (before you request it :)) Try Wireshark 2.0 or the latest.

permanent link

answered 07 Sep '16, 00:54

Micha%C5%82%20%C5%81ab%C4%99dzki's gravatar image

Michał Łabędzki
411
accept rate: 8%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×34
×27

question asked: 01 Mar '16, 11:16

question was seen: 1,973 times

last updated: 07 Sep '16, 00:54

p​o​w​e​r​e​d by O​S​Q​A