This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Malformed Packet Errors

0

Hey Guys

At a clients house we have some issues with the network. I´ve started Wireshark to trace everything. In 15 minutes we got about 128 Malformed Packet errors (IPV6). Can you tell me what that exactly is?

Thank you guys!

asked 29 Jun '17, 02:48

L33tus's gravatar image

L33tus
6112
accept rate: 0%

Not without the capture file.

(29 Jun '17, 03:48) Jaap ♦

Shall I upload the whole File (Wireshark - File - Export)? Or can I just upload one file just with the "Warnings" and the "Errors"?

(29 Jun '17, 07:56) L33tus

For malformed packets, it may or may not be enough to see only those frames which are marked as malformed packets, depending on whether the reported malformation is related to data which are individual to that packet or to data which are reassembled from several packets. So better the complete file. Anonymisation is not a good idea in this particular case, so you are kind of trapped if you are concerned about privacy.

(29 Jun '17, 12:30) sindy

I´m not sure if it´s safe if I upload my whole file... Isn´t there a private message function? Then I would send this to a moderator.

(29 Jun '17, 22:39) L33tus

Isn´t there a private message function?

Not at this site, this is possible when filing a bug at Wireshark bugzilla.

I'd say you should take the original file, find the numbers of the first, say, 5 "malformed" packets and export these 5 into another file using File -> Export Specified Packets and filing the Range field with a comma-separated list of their numbers. Then, you would keep the original file open and the new file as well, and compare whether the malformation is reported at exactly the same place in each of those five packets in the original file and the new one. If yes, posting the exported file is enough. If not, post it anyway, because knowing the type of those packets can tell us what filter you should use to select a single packet stream which contains the issue.

You cannot upload a capture file to this site, you have to upload it to Cloudshark or any generic file sharing service and place a link to it here, at best by editing the Question.

(29 Jun '17, 22:52) sindy