Re: Packet Size limited during capture message

[Brian Oleksa <oleksab () darkcornersoftware com>]

Guy / Bill / Chris / Jakub / Mike

So I did some more troubleshooting only to find the following:
The dissector crashes in WinXP but not on my Fedora Core 9 box. This is 
weird.

Using editcap... I was able to find the frame on windows to which 
wireshark crashed on (which was frame 17641).
I opened the same .pcap file on my FC-9 box (it did not crash)...but I 
went to frame 17641 only to find out that it is a Malformed Packet.

How I determine if it is a Helen packet or not....is that all helen 
packets start with 0xbead which is the "magic number". I have never had 
this problem before as I found thousands of Helen packets this way. But 
this malformed packet has a magic number of 0x293e  .... which then 
through the rest of the packet info off and crashed wireshark (on Windows).

Any thoughts..??

Do I need to make sure that the hf_helen_magic is equal to 
0xBEAD.....and if not I discard this packet..??

Why did it find this packet and assume that it was a  Helen Packet..?? 
Was it because 0x293e is equal to 0xBEAD in length so it just assumed it 
was a helen packet..??

Attached is the code.

Thanks for your help,
Brian

Attachment: packet-helen.c
Description:

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe