[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 Jaap Keuter changed: What|Removed |Added Status|CONFIRMED |RESOLVED Resolution|--- |FIXED --- Comment #16 from Jaap Keuter --- Although missing from the Release Notes, this bug fix was included in 3.2.3. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #15 from Guy Harris --- (In reply to Jaap Keuter from comment #13) > (In reply to Guy Harris from comment #10) > > Block 6 has a length of 646 bytes; that is *not* a multiple of 4. > > The capture file dissector could use an expert item here? It has one in the master branch: https://code.wireshark.org/review/36746 -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #14 from Jaap Keuter --- (In reply to levente.meszaros from comment #11) > I agree with your analysis. With my last comment I only wanted to note that > if the interface is not looked at when dissecting the conversation, then the > dissector may be confused again by completely unrelated frames on other > interfaces. Yes, but this is a more generic problem which comes up at every layer in the protocol stack. Image different VLANs, Provider bridges, MPLS labels, IP-in-IP, tunnels of all kinds, etc. Currently there are limited features incorporated to handle this, the so called conversation mechanism. It basically does this by means of endpoint identification, which started with TCP and UDP connections, but is being stretched to cover other endpoint types as well. Unfortunately this design can only bring us so far, to create a solid solution a partial redesign of the dissection engine is needed, to create the concept of context, starting at the lowest layer (phy). BTW: current solution works by the grace of the interface direction (In/Out) being present for the frames in the capture file. If not then this won't work either. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #13 from Jaap Keuter --- (In reply to Guy Harris from comment #10) > Please note, by the way, that the pcapng file attached to the bug is invalid. > Which is easily spotted when loading the capture file as File Format, see the View menu. > Note the last sentence. > > Block 6 has a length of 646 bytes; that is *not* a multiple of 4. The capture file dissector could use an expert item here? -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #12 from levente.mesza...@gmail.com --- Oh, I've just seen your finding regarding Block Total Length. Thanks again, I will fix this issue. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #11 from levente.mesza...@gmail.com --- I agree with your analysis. With my last comment I only wanted to note that if the interface is not looked at when dissecting the conversation, then the dissector may be confused again by completely unrelated frames on other interfaces. BTW, I'm recording these PCAPng files from a network simulator, and it would be very helpful if Wireshark could understand the conversations even if multiple interfaces are recorded in the same file. For example, I could use Wireshark to understand what's going on in a switch or a router. Anyway, I just wanted to say thank you! -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #10 from Guy Harris --- Please note, by the way, that the pcapng file attached to the bug is invalid. To quote section 3.1 "General Block Structure": http://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?url=https://raw.githubusercontent.com/pcapng/pcapng/master/draft-tuexen-opsawg-pcapng.xml&modeAsFormat=html/ascii&type=ascii#rfc.section.3.1 of the current version of the pcapng spec: Block Total Length (32 bits): an unsigned value giving the total size of this block, in octets. For instance, the length of a block that does not have a body is 12 octets: 4 octets for the Block Type, 4 octets for the initial Block Total Length and 4 octets for the trailing Block Total Length. *This value MUST be a multiple of 4.* Note the last sentence. Block 6 has a length of 646 bytes; that is *not* a multiple of 4. Wireshark's pcapng reader *happens* to round block lengths that are not a multiple of 4 up to the next multiple of 4, but there is *no* guarantee that all pcapng readers will do so - in fact, at least one is known *not* to do so. If that was written by code maintained by you or your organization, please fix it. If it wasn't, please report the bug to the people who *do* maintain it, telling them that it violates the pcapng spec and must be fixed. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #9 from Guy Harris --- (In reply to levente.meszaros from comment #4) > Great, thanks! > > If we are at it, will this also work if there are multiple interfaces in the > PCAPng trace file? I've been staring at clause 99 of IEEE Std 802.3-2018, and, at least as I understand it: Protocols running atop Ethernet hand to the MAC service layer, via MA_DATA.request, a quadruplet of: * destination MAC address; * source MAC address; * the MSDU; * the FCS. If preemption is being used, the MAC service layer hands the MAC PDU to the MAC Merge service layer, which processes it in the eMAC or the pMAC. If it's handed to the eMAC, the eMAC turns around and hands an mPacket, composed of the preamble, the appropriate SMD octet, and the MAC PDU to the physical layer, one bit at a time via a PLS_DATA.request. If it's handed to the pMAC, the pMAC starts handing an mPacket, composed of the preamble, the appropriate SMD octet, and the MAC PDU to the physical layer, one bit at a time via PLS_DATA.request. However, if the MAC Merge service layer gets a HOLD request via MM_CTL.request, it stops handing the mPacket to the physical layer as soon as it can, replacing the FCS part of the MAC PDU with an FCS for the fragment, and holds onto the remainder of the original MAC PDU, waiting until it gets a RELEASE request MM_CTL.request, at which point it starts sending out a continuation fragment composed of a continuation fragment preamble, the appropriate SMD octet and frag count, and the remainder of the MAC PDU to the physical layer. That, in turn, is also preemptable in the same fashion. So all fragments of a fragmented preempt able packet go over the same physical layer, and *should* show up on the same interface. Therefore, *as long as reassembly is done on a per-interface basis*, that should work. If we support having only one conversation in progress and one reassembly in progress, that will *not* necessarily work if there's more than one interface in the capture with LINKTYPE_ETHERNET_MPACKET. Note also that, at least as I read clause 99, the reassembly code should *also* check that the frame counts are the same in all the fragments being reassembled; this is presumably done to make sure the receiver doesn't glue together fragments from different MAC PDUs, in case, for example, some fragments don't make it from the sender to the receiver. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 Guy Harris changed: What|Removed |Added Hardware|x86-64 |All OS|Linux |All -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #8 from Jaap Keuter --- (In reply to levente.meszaros from comment #4) > Great, thanks! > > If we are at it, will this also work if there are multiple interfaces in the > PCAPng trace file? No, that level of granularity is not incorporated into the dissection engine as of yet. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #7 from Gerrit Code Review --- Change 36733 merged by Guy Harris: FPP: Make dissector directionally aware https://code.wireshark.org/review/36733 -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #6 from Gerrit Code Review --- Change 36733 had a related patch set uploaded by Jaap Keuter: FPP: Make dissector directionally aware https://code.wireshark.org/review/36733 -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #5 from Gerrit Code Review --- Change 36731 merged by Anders Broman: FPP: Make dissector directionally aware https://code.wireshark.org/review/36731 -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #4 from levente.mesza...@gmail.com --- Great, thanks! If we are at it, will this also work if there are multiple interfaces in the PCAPng trace file? -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #3 from Gerrit Code Review --- Change 36731 had a related patch set uploaded by Jaap Keuter: FPP: Make dissector directionally aware https://code.wireshark.org/review/36731 -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 Jaap Keuter changed: What|Removed |Added Ever confirmed|0 |1 Status|UNCONFIRMED |CONFIRMED --- Comment #2 from Jaap Keuter --- Thanks for the clear capture file. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 levente.mesza...@gmail.com changed: What|Removed |Added CC||levente.mesza...@gmail.com -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 levente.mesza...@gmail.com changed: What|Removed |Added Version|2.6.10 |3.2.2 Hardware|x86 |x86-64 -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16470] The IEEE 802.3br frame preemption dissector is confused by unrelated packets
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470 --- Comment #1 from levente.mesza...@gmail.com --- I've just checked Wireshark 3.2.2 and it has the same problem. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
