misc/175645: tcpdump incorrectly decodes pflog'ged UDP packet as
>Number: 175645
>Category: misc
>Synopsis: tcpdump incorrectly decodes pflog'ged UDP packet as ATALK
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Jan 28 09:10:00 UTC 2013
>Closed-Date:
>Last-Modified:
>Originator: Dmitry Dvoinikov
>Release: 8.3
>Organization:
www.infosysco.ru
>Environment:
FreeBSD foo 8.3-RELEASE-p5 FreeBSD 8.3-RELEASE-p5 #1: Wed Dec 12 23:29:24 YEKT 2012 admin@foo:/opt/obj/opt/src/sys/FOO i386
>Description:
Some UDP packet, saved by pflog, is decoded incorrectly as ATALK.
tcpdump output:
# tcpdump -r packet.pcap
reading from file packet.pcap, link-type PFLOG (OpenBSD pflog file)
11:22:11.296532 IP 115.61.0.254 > 143.12.228.91: at-#100 5
whereas the (presumably correct) wireshark output:
Frame 1: 110 bytes on wire (880 bits), 110 bytes captured (880 bits)
PF Log IPv4 pass on ifc by rule 0
Internet Protocol Version 4, Src: 172.30.0.11 (172.30.0.11), Dst: 193.120.212.22 (193.120.212.22)
User Datagram Protocol, Src Port: 55573 (55573), Dst Port: 16605 (16605)
Data (18 bytes)
>How-To-Repeat:
openssl base64 -d > packet.pcap << EOF
1MOyoQIABAAAAAAAAAAAAHQAAAB1AAAAAwsGUVSGBABuAAAAbgAAAD0CAABpZmMA
AAAAAAAAAAAAAAAAYW5jaG9yX25hbWUAAAAAAAAAABwAAAAC/////6CGAQAAAAAA
ggUAAAEAAABFAAAuAABAAEAR+QasHgALwXjUFtkVQN0AGrhGUxUCmI8Mcz3kAFv+
ZGyAi27Z
EOF
tcpdump -r packet.pcap
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
_______________________________________________
freebsd-bugs@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscribe@freebsd.org"