Thanks for the clarification. Could you please confirm whether this change (MR 23056) is expected to be included in the next Wireshark 4.6.3 release? Thanks, Kundan
On Sun, Jan 11, 2026 at 7:34 PM chuck c <[email protected]> wrote: > lwres: Do not claim (unregistered) port 921 > https://gitlab.com/wireshark/wireshark/-/merge_requests/23056 > > Wireshark sometimes assumes the lower (smaller) port number in a > conversation is the server. > The change above should fix that for lwres but there may be other source > ports lower than 4789 that will show the same behavior. > > On Sun, Jan 11, 2026 at 12:09 AM kundan kumar <[email protected]> > wrote: > >> Hello Wireshark Dev Team, >> >> I am sending valid VXLAN packets with *UDP destination port 4789*. When >> the UDP source port is an *ephemeral (high-numbered) port*, Wireshark >> decodes the packets correctly as VXLAN. However, when the UDP source port >> is *921* and the destination port is still 4789, the same packets are >> decoded as *LWRES* instead of VXLAN. Could you please help explain why >> this behavior occurs? >> >> Thanks, >> Kundan >> _______________________________________________ >> Wireshark-dev mailing list -- [email protected] >> To unsubscribe send an email to [email protected] >> > _______________________________________________ > Wireshark-dev mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ Wireshark-dev mailing list -- [email protected] To unsubscribe send an email to [email protected]
