Skip to content
This repository has been archived by the owner on Apr 14, 2024. It is now read-only.

IPv6 import from PCAP file leads to diff in ipv6.version #369

Open
pstavirs opened this issue Nov 16, 2023 · 0 comments
Open

IPv6 import from PCAP file leads to diff in ipv6.version #369

pstavirs opened this issue Nov 16, 2023 · 0 comments
Labels
Milestone

Comments

@pstavirs
Copy link
Owner

This is dependent on tshark version.

With tshark 3.2.4, the PDML generated is

  <proto name="ipv6" showname="Internet Protocol Version 6, Src: fe80::b60c:25ff:fe05:8e10, Dst: ff02::5" size="40" pos="14">
    <field name="ipv6.version" showname="0110 .... = Version: 6" size="1" pos="14" show="6" value="6" unmaskedvalue="6c"/>
    <field name="ip.version" showname="0110 .... = Version: 6 [This field makes the filter match on &quot;ip.version == 6&quot; possible]" hide="yes" size="1" pos="14" show="6" value="6" unmaskedvalue="6c"/>

With tshark 3.4.7, the PDML generated is

  <proto name="ipv6" showname="Internet Protocol Version 6, Src: fe80::b60c:25ff:fe05:8e10, Dst: ff02::5" size="40" pos="14">
    <field name="ipv6.version" showname="0110 .... = Version: 6" size="1" pos="14" show="6" value="6c"/>
    <field name="ip.version" showname="0110 .... = Version: 6 [This field makes the filter match on &quot;ip.version == 6&quot; possible]" hide="yes" size="1" pos="14" show="6" value="6" unmaskedvalue="6c"/>

The value field of ipv6.version is different - 6 vs 6c - the latter value leads to ipv6.version being set to 12 (0xc) instead of 6 when imported into an Ostinato stream

@pstavirs pstavirs added the bug label Nov 16, 2023
@pstavirs pstavirs added this to the v1.4 milestone Nov 16, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

1 participant