I'm opening the same pcap in windows and in linux, and I get different results. Protocol pn_rt / pn_io is shown in the linux version as fake-field-wrapper (DATA) and it is fully parsed in the windows version (both 2.0.1) any idea why it happens ? asked 09 Aug '16, 00:40  kdani edited 09 Aug '16, 02:27  grahamb ♦ |
2 Answers:
Profinet is dissected by a plugin, sounds as though the plugin isn't being loaded on Linux. Does the Profinet plugin show up in the Help -> About Wireshark -> Plugins list? answered 09 Aug '16, 02:13 grahamb ♦ |
This is most likely caused by different Wireshark profile settings, e.g. reassembly preferences. Can you create a new profile (meaning, Wireshark will run with default settings) on both systems and compare again? If the results are identical with brand new profiles, you have something that's different in your existing settings - otherwise it's really Wireshark that's doing something different. answered 09 Aug '16, 01:03  Jasper ♦♦ I've copied the preference file from the windows machine to the linux machine - same results. is there anything else ? I am installing a clean linux now to test a clean wireshark installation. will report soon. (09 Aug '16, 01:26) kdani |
I think you got it right. checking.