Revision history [back]

In Wireshark preferences, go to Protocols -> PER then
enable Display the internal PER fields in the tree.
(Or go to Advanced, search for per. and set
per.display_internal_per_fields Changed Boolean TRUE)

For frame 251 the length is 35:00 hex but probably should be 00:35 to match the data present:

data-field: 1 item
    Item 0
        Data-Field item
            1... .... Optional Field Bit: True (field-data is present)
            Min: 0
            Range: 8
            Bitfield length: 3
            Bits: .110 .... decimal value: 6
            Enumerated Index: 6
            field-type: t4-non-ecm-data (6)
            Octet String Length: 13569

Add per.octet_string_length as a column and set a display filter of _ws.malformed.expert to see other malformed packets with lengths that seem to not match the data present.