Ask Your Question
0

Error to display multicast packet

asked 2021-04-27 00:19:51 +0000

jobaek gravatar image

updated 2021-04-28 20:09:33 +0000

grahamb gravatar image

Hello,

Thanks to supply wireshark.

My device transmit data as source port 5101 ~ 5108 in UDP. And destination port 5100, and support Multicast packet 60001 ~ 60008.

This is normal packet.

image good status

My device send data such as normal packet image. 5104 : transmit to 5100 and 60004 5102 : transmit to 5100 and 60003 (transmit from one source port to two destination port(5100 and multicast port(60001 ~ 60008)

But, wireshark doesn't display some multicast packets.

image bad status

But, sometimes doesn't display(capture) multicast packet such as error packet image.

So, wireshark display is good after click "Restart current capture".

This symptom occurs often.

I upload the log file in share folder. https://drive.google.com/drive/folder...

ZMG-390_Log.pcapng Normal operation is until line 948. My device pause to transmit data. and restart. Wireshark is no capture multicast packet after line 949.

This file is after "Restart current capture". ZMG-390_Log_restart.pcapng

Thanks.

Best regards, Baek.

v3.4.4 and v3.4.5 are same conditions.

edit retag flag offensive close merge delete

Comments

Can you give more detail about what the error is? (What is the difference between the screenshots?)

Chuckc gravatar imageChuckc ( 2021-04-27 14:40:55 +0000 )edit

Thanks for comment.

My device send data such as normal packet image. 5104 : transmit to 5100 and 60004 5102 : transmit to 5100 and 60003 (transmit from one source port to two destination port(5100 and multicast port(60001 ~ 60008) But, sometimes doesn't display multicast packet such as error packet image. When this situation, I click "Restart current capture" and it is recovery.

jobaek gravatar imagejobaek ( 2021-04-27 15:02:12 +0000 )edit

Thanks for the explanation. Can you provide a capture file that has this issue?

Chuckc gravatar imageChuckc ( 2021-04-27 15:18:15 +0000 )edit

okay. I will capture the receive packets at tomorrow. and I will upload it.

jobaek gravatar imagejobaek ( 2021-04-27 15:20:11 +0000 )edit

Is this post analysis or live analysis? What I found is permit Wireshark to finish whatever it doing before trying a new one. Wireshark doesn''t crash or complain, but the results will be skewed.

BigFatCat gravatar imageBigFatCat ( 2021-04-27 17:14:38 +0000 )edit

It is live analysis. I capture the log file. This result is not captured as multicast packet.

jobaek gravatar imagejobaek ( 2021-04-28 00:24:11 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-04-28 11:31:51 +0000

BigFatCat gravatar image

updated 2021-04-28 11:54:05 +0000

Hi, I see in the ZMG-390_Log.pcapng capture after packet 948, the next multicast packet is 976 approximately 23.493sec later. Did you notice that is when Wireshark starts reporting IPv4 checksum errors and IPv6 multicast packets? Wireshark believes this could "IP checksum offload". The other file doesn't have IPv4 checksum errors or IPv6. Filter for IPv4 checksum is "ip.checksum_bad.expert"

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-04-27 00:19:51 +0000

Seen: 435 times

Last updated: Apr 28 '21