This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

WireShark and Jumbograms

1

Dear *,

I'm currently investigating the effects of IPv6 Jumbograms on a network (IP packets of up to 4GiB). However, Wireshark does not seem to support packet sizes over IPv4's maximum, 64k.

I've already edited and recompiled libpcap and wireshark from source to allow a higher snaplen, but it seems that whenever I send a packet being > 64k, the received data loops and restarts at 0. The length of the packet shows fine, but the received data somehow gets looped back. The maximum I can make it understand is around 65435, everything in the margin of 200 bytes around that value returns a Malformed Packet and if I send data in the regions of 70000, the received data on WireShark will be around 4000+ bytes.

I'm just wondering how WireShark is supporting Jumbograms and if there are any modifications I could make to the source to help me in making WireShark understand them :)

Greetz,

Jack

asked 14 Mar '12, 10:56

Jack's gravatar image

Jack
16113
accept rate: 0%

edited 14 Mar '12, 11:36