When viewing erspan packets in wireshark, I get malformed packets. The packet are good, but wireshark is not interpreting the packet correct. Packet is formed : EtherII - ip - gre - erspan - etherII - IP - ipdata The first etherII has a trailer of 32 bytes, which is odd the ip headers have the correct 'total length', taking into account the extra 32 bytes of the (etherII-ip-gre-erspan) headers the last ip header shows the correct length, the same as the original packet before encapsulation. ex an ICMP packet: the ipdata portion of the original ip packet 80 bytes total length with 20bytes header, leaving 60 bytes for the icmp packet. Icmp has an 8 byte header, leaving 52 bytes of data, but wireshark reports 20 bytes, which is 32 bytes too short I guess this is a bug in wireshark parsing, put I'm not sure how to report it Pieter asked 25 Jun '14, 07:02 PieterL |
One Answer:
Second entry from Google search of "wireshark bugs", on the wiki: Reporting Bugs. answered 25 Jun '14, 08:35 grahamb ♦ |
Link to the bugreport https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10230 It is not a Wireshark bug, but a Cisco bug.