Home page logo
/

wireshark logo Wireshark mailing list archives

Re: Malformed packet analysis
From: Anders Broman <anders.broman () ericsson com>
Date: Mon, 13 Jan 2014 08:58:36 +0000

Hi,
By reading the dissector code and compare with the analyzed packet and the RFC :)

The most common reason for [Malformed] is that Wireshark think that there is more data to read than what's in the 
packet so you might want to check your length parameters, optional vs required fields
Etc. I assume Wireshark makes the right assumption of the packet content e.g. the right dissector(s) are called.

If you show us the trace we could analyze it further.
Best regards
Anders

From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Markus 
Moeller
Sent: den 12 januari 2014 19:50
To: wireshark-users () wireshark org
Subject: [Wireshark-users] Malformed packet analysis

Hi,

   I am working on a packet generator and when I analyse the packets I create with wireshark I get a malformed packet.  
I think I created the packet following the RFC. How can I find our the exact reason why wireshark create the error ?


Thank you
Markus
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]