Skip to content
GitLab
    • GitLab: the DevOps platform
    • Explore GitLab
    • Install GitLab
    • How GitLab compares
    • Get started
    • GitLab docs
    • GitLab Learn
  • Pricing
  • Talk to an expert
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
    • Switch to GitLab Next
    Projects Groups Topics Snippets
  • Register
  • Sign in
  • wireshark wireshark
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
    • Locked files
  • Issues 1.4k
    • Issues 1.4k
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 179
    • Merge requests 179
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Artifacts
    • Schedules
    • Test cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Model experiments
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Code review
    • Insights
    • Issue
    • Repository
  • Wiki
    • Wiki
  • External wiki
    • External wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Wireshark FoundationWireshark Foundation
  • wiresharkwireshark
  • Issues
  • #17355
Closed
Open
Issue created Apr 20, 2021 by billyMarshallCalnex@billyMarshallCalnex

IEEE-1588 Signalling Unicast TLV incorrectly reported as being malformed

Summary

IEEE-1588 (PTP) packets of type Signalling (Request Unicast Transmission & Grant Unicast Transmission) are incorrectly reported as being malformed. It maybe that this affects other Unicast TLV's but I have not been able to test this.

This appears to be an issue with the "lengthField" byte. The IEEE standard mandates this field must be 6 for Request, and 8 for Grant, however in my opinion the dissector is evaluating the inserted final 2 octets of the UDP Payload that are inserted for IPv6 and incorrectly identifying them as part of the TLV, thereby thinking the TLV is 2 bytes longer than it actually is, and therefore incorrect as per the value in the lengthField. I think this because changing the lengthField byte from 0x08 to 0x10 in a Grant packet enables Wireshark dissect the packet (even though the value for that byte is now wrong as per the standard).

Steps to reproduce

Capture IEEE 1588 Signalling packets (Request Unicast Transmission & Grant Unicast Transmission) with encapsulation type IPv6.

What is the current bug behavior?

Packet reports as being malformed

What is the expected correct behavior?

Packets are dissected correctly.

Sample capture file

Attached.

Relevant logs and/or screenshots

![2021-04-20_13_48_39-IEEE_1588-2019.pdf_-_Foxit_Reader](/uploads/f70556ea78ebf955b9afd97f508f625c/2021-04-20_13_48_39-IEEE_1588-2019.pdf_-_Foxit_Reader.png)

![2021-04-20_13_48_55-IEEE_1588-2019.pdf_-_Foxit_Reader](/uploads/4a29b9bab0eacac994961339f1b93a9b/2021-04-20_13_48_55-IEEE_1588-2019.pdf_-_Foxit_Reader.png)

[IEEE-1588_PTP_oIPv6_signalling_unicastTLV_malformed_packets.pcap](/uploads/2bfc4770f39b60faa4a64ef130676170/IEEE-1588_PTP_oIPv6_signalling_unicastTLV_malformed_packets.pcap)

Build information

3.4.4 (v3.4.4-0-gc33f6306cbb2)

Compiled (64-bit) with Qt 5.15.1, with libpcap, with GLib 2.52.3, with zlib
1.2.11, with SMI 0.4.8, with c-ares 1.15.0, with Lua 5.2.4, with GnuTLS 3.6.3
and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB
resolver, with nghttp2 1.39.2, with brotli, with LZ4, with Zstandard, with
Snappy, with libxml2 2.9.9, with QtMultimedia, with automatic updates using
WinSparkle 0.5.7, with AirPcap, with SpeexDSP (using bundled resampler), with
Minizip.

Running on 64-bit Windows 10 (2009), build 19042, with Intel(R) Core(TM)
i5-10310U CPU @ 1.70GHz (with SSE4.2), with 15980 MB of physical memory, with
locale English_United Kingdom.utf8, with light display mode, without HiDPI, with
Npcap version 1.10, based on libpcap version 1.9.1, with GnuTLS 3.6.3, with
Gcrypt 1.8.3, with brotli 1.0.2, without AirPcap, binary plugins supported (21
loaded).

Built using Microsoft Visual Studio 2019 (VC++ 14.28, build 29910).
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking