Ask Your Question
0

Unable to display IEEE1722-1 packet in Wireshark 3.0.3

asked 2019-08-17 17:34:54 +0000

swong gravatar image

updated 2019-08-17 18:41:15 +0000

I am trying to reproduce the IEEE1722-1 packet capture example, as seen in the copy of Wireshark on the right in the below screen capture. We can see that Wireshark recognized the packet type being IEEE1722-1 in Packet Detail pane. In the copy of Wireshark on the left, I tried to capture the IEEE1722-1 traffic. Wireshark can not recognize the packet being an IEEE1722-1 packet. But if I look at it closely the bytes in the Data fields, the bytes are being layout in IEEE1722-1 format. It looks as if I am not configured Wireshark properly to examine IEEE1722-1 packet.

How do I configure my Wireshark 3.0.3 so I can monitor and analyze IEEE1722-1 packets?

Wireshark screenshot link

https://photos.app.goo.gl/baicq8TZoCg...

Sorry I was not able to upload the screenshot. I enclosed a link to my google shared album for the screenshot instead.

Below are the cap files

Data for Wireshark at the right (ieee1722 example)

Data for Wireshark at the left (my capture attempt of ieee1722 packet)

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-08-17 18:13:15 +0000

grahamb gravatar image

Would be easier to help if you could provide a capture.

The capture on the right of your image is IEEE 1722 over Ethernet. The capture on the left is IEEE 1722 over UDP, on ports 27221 and 37221. The default UDP port for IEEE 1722 is 17220 and the dissector does not provide a preference to change that, nor does it provide a "Decode As..." option.

If the data actually is IEEE 1722 then your options seem to be:

  • Recompile Wireshark setting the dissector port to be those used in your capture.
  • Modify your capture to use port 17220, e.g. by using a tool such as TraceWrangler.

However, that might not be required. It seems the data in the capture on the left might be encapsulated Ethernet\IEEE 1722 can you try right-clicking the "data" item, choose "Decode As..." and then in the column named "Current" choose "Ethernet" from the droplist.

edit flag offensive delete link more

Comments

grahamb,

I tried to right click on data and choose the item 'Decode As'. Under current is (none). When I change it to Ethernet through a drop down on that field. I was able to see the data properly. Thanks for your help

swong gravatar imageswong ( 2019-08-17 18:46:44 +0000 )edit

grahamb, Thanks you very much for your help.

swong gravatar imageswong ( 2019-08-17 18:47:51 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-08-17 17:34:54 +0000

Seen: 445 times

Last updated: Aug 17 '19