Skip to content
GitLab
    • GitLab: the DevOps platform
    • Explore GitLab
    • Install GitLab
    • How GitLab compares
    • Get started
    • GitLab docs
    • GitLab Learn
  • Pricing
  • Talk to an expert
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
    • Switch to GitLab Next
    Projects Groups Snippets
  • Register
  • Sign in
  • wireshark wireshark
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Locked Files
  • Issues 1,360
    • Issues 1,360
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 175
    • Merge requests 175
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
    • Test Cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Code review
    • Insights
    • Issue
    • Repository
  • Wiki
    • Wiki
  • External wiki
    • External wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Wireshark FoundationWireshark Foundation
  • wiresharkwireshark
  • Issues
  • #18136
Closed
Open
Issue created Jun 15, 2022 by TobiasKnauss@TobiasKnauss

UDP packets falsely marked as "malformed packet"

Summary

Wireshark falsely marks some packets as malformed. The packets are correctly received and displayed by the receiver side.

Steps to reproduce

Use a UDP terminal software like "HW Group Hercules", create a UDP connection and send a single byte from the range 0x80 to 0xbf.
Example: Configure like in the screenshot below (with suitable IP address) and hit all 3 "send" buttons.
image

Notice: The textboxes of "received data" and "sent data" have a context menu where you can enable Hex View to show non-printable characters.
First select "Special Chars" -> anything but "Text Mode", then select "HEX Enable".

The sent UDP data will produce:
image

Alternative way: C# code

for (int index = 0; index < 10000; index++)
{
  Thread.Sleep (5);  // without sleep, it may be too fast for the receiver side.
  udpClient1.Send (new[] { (byte)index }, 1, remoteIPAddress, 44444);
}

What is the current bug behavior?

A "malformed packet" hint in the info column.

What is the expected correct behavior?

No "malformed packet" hint in the info column.

Sample capture file

wireshark_udp_bug.pcapng

Relevant logs and/or screenshots

screenshots: see above.

Build information

3.6.5 (v3.6.5-0-g21f79ddbefbd)

Compiled (64-bit) using Microsoft Visual Studio 2019 (VC++ 14.31, build 31107),
with Qt 5.15.2, with libpcap, with GLib 2.66.4, with zlib 1.2.11, with Lua
5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.8.3, with MIT
Kerberos, with MaxMind DB resolver, with nghttp2 1.44.0, with brotli, with LZ4,
with Zstandard, with Snappy, with libxml2 2.9.10, with libsmi 0.4.8, with
QtMultimedia, with automatic updates using WinSparkle 0.5.7, with AirPcap, with
SpeexDSP (using bundled resampler), with Minizip.

Running on 64-bit Windows 10 (1809), build 17763, with Intel(R) Core(TM)
i7-8550U CPU @ 1.80GHz (with SSE4.2), with 16227 MB of physical memory, with
GLib 2.66.4, with Qt 5.15.2, with Npcap version 1.55, based on libpcap version
1.10.2-PRE-GIT, with c-ares 1.17.0, with GnuTLS 3.6.3, with Gcrypt 1.8.3, with
nghttp2 1.44.0, with brotli 1.0.9, with LZ4 1.9.3, with Zstandard 1.4.0, without
AirPcap, with light display mode, without HiDPI, with
LC_TYPE=German_Germany.utf8, binary plugins supported (21 loaded).
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking