TFTP dissector bug type listed as netscii instead of netascii doesn't show all TFTP packets including TFTP blocks
Summary
Wireshark doesn't recognized tftp blocks when type is netascii. Note dissector below mentions netscii, not netascii. Suspect netascii type is misspelled in dissector. Note tftp dissector used with Wireshark version 3.0.5 worked correctly. Version 4.2.0 doesn't.
From epan/eissectors/packet-tftp.c:
const gchar* modes[] = {"netscii", "octet", "mail"};
for(guint i = 0; i < array_length(modes); ++i) {
if (g_ascii_strcasecmp(mode, modes[i]) == 0) return TRUE;
}
Sample capture file
Steps to reproduce
load pcap in wireshark and use tftp filter. Note tftp blocks are not displayed but instead show up as UDP traffic. tftp type is netascii. When a pcap is loaded with tftp type as octet, blocks display properly. Suspect dissector misspelling of netascii the problem.
What is the current bug behavior?
Doesn't show all tftp traffic specifically tftp packets that don't use port 69 (tftp blocks).
What is the expected correct behavior?
All tftp traffic should be displayed including traffic using ports other than port 69.
Build information
Version 4.2.0 (v4.2.0-0-g54eedfc63953).
Compiled (64-bit) using Microsoft Visual Studio 2022 (VC++ 14.37, build 32822),
with GLib 2.78.0, with Qt 6.5.3, with libpcap, with zlib 1.3.0, with PCRE2, with
Lua 5.2.4 (with UfW patches), with GnuTLS 3.7.9 and PKCS #11 support, with
Gcrypt 1.10.2-unknown, with Kerberos (MIT), with MaxMind, with nghttp2 1.57.0,
with nghttp3 1.0.0, with brotli, with LZ4, with Zstandard, with Snappy, with
libxml2 2.11.5, with libsmi 0.5.0, with QtMultimedia, with automatic updates
using WinSparkle 0.8.0, with AirPcap, with Minizip, with binary plugins.
Running on 64-bit Windows 11 (22H2), build 22621, with Intel(R) Core(TM)
i7-8665U CPU @ 1.90GHz (with SSE4.2), with 16190 MB of physical memory, with
GLib 2.78.0, with Qt 6.5.3, with Npcap version 1.78, based on libpcap version
1.10.4, with PCRE2 10.42 2022-12-11, with c-ares 1.19.0, with GnuTLS 3.7.9, with
Gcrypt 1.10.2-unknown, with nghttp2 1.57.0, with nghttp3 1.0.0, with brotli
1.0.9, with LZ4 1.9.3, with Zstandard 1.5.2, without AirPcap, with light display
mode, without HiDPI, with QPA plugin "windows", with LC_TYPE=English_United
States.utf8, binary plugins supported.
Edited by Guy Harris