why am i getting malformed packet in default display panel where as same packet is properly decoded in a new popup window

asked 2018-11-27 04:51:18 +0000

this post is marked as community wiki

This post is a wiki. Anyone with karma >750 is welcome to improve it.

Hi,

when i open a pcap file in a wireshark 2.6.3, it displays malformed errors for few packets in default display panel however it decodes properly when i open the same in new pop up window (double clicking on a specific packet).

i am not getting what could be the issue for diff behaviors

dissect()
{
    case NRachPdu:
    {
        proto_item *NRach     = NULL;
        proto_tree *NRachTree = NULL;

        offset += 1;
        // get the size of PDU
        tvb_memcpy(tvb, (guint8 *)&length, offset, 1);
        //length = tvb_get_ntohs(tvb, offset);
        NRachTree = proto_tree_add_subtree(fapi_tree, tvb, offset-1, length, ett_fapi_NRach, &NRach, "NRACH PDU");
        proto_tree_add_item(NRachTree, hf_fapi_NRachpdusize, tvb, offset, 1, encoding);
        ..................
}
edit retag flag offensive close merge delete