Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Frames are undecoded and have funny bytes in header

This is a WIN 10 installation. I'm getting frames from npcap with the capture filter "udp port 23456" when I send UPD messages to port 23456. I can also sniff the UDP packets with "packet sender"-app. But on the Wireshark GUI they are not decoded and the raw frame data shown seems to have the correct UDP data part but the Ip header has several additional bytes. I have completely uninstalled Wireshark and npcap and reinstalled it fresh with the newest version several times now. nothing changes. I'v tried several LAN and WLAN ports - all the same. I do not receive any decoded frames at all. Just these funny frames without decoding. I'm lost...

    0000   ff ff ff ff ff ff 08 b6 1f 29 98 74 08 00 45 00   .........).t..E.
    0010   00 26 00 22 00 00 ff 11 48 db c0 a8 b2 21 ff ff   .&."....H....!..
    0020   ff ff 30 39 5b a0 00 12 02 25 00 01 ff 00 00 00   ..09[....%......
    0030   00 00 00 00 00 00 00 00 00 00 00 00               ............

UDP payload data is 10 bytes: 00 01 ff 00 00 00 00 00 00 00

In the GUI there is only data in columns "Time" and "length". No source, no destination, no protocol. The protocol s are active as per default after installation.