Wireshark interprets If_fcslen option in the Interface Description Block as byte instead of bit.

Summary

Hi,

According to the pcapng specification specs, the If_fcslen indicates the FCS len in bit. We have a tool that export pcapng file with if_fcslen option in bits as unit. This leads to an error in Wireshark. (see picture)

Steps to reproduce

Export the pcapng with our tool and import it with Wireshark 4

What is the current bug behavior?

Wireshark 4 complains about malformed IP packets. When I change the option in our tool that the if_fcslen is in bytes, Wireshark can recognize the packets.

What is the expected correct behavior?

It should follows the pcapng specification that the if_fcslen option is an 8-bit unsigned integer value that specifies the length of the Frame Check Sequence (in bits) for this interface.

Relevant logs and/or screenshots

Build information

Wireshark 4+

Edited Jul 03, 2023 by Tien Tran

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information