Bug 175645 - tcpdump(1) incorrectly decodes pflog'ged UDP packet as ATALK
Summary: tcpdump(1) incorrectly decodes pflog'ged UDP packet as ATALK
Status: Closed Overcome By Events
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: Unspecified
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-01-28 09:10 UTC by Dmitry Dvoinikov
Modified: 2020-07-11 18:51 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Dmitry Dvoinikov 2013-01-28 09:10:00 UTC 
Some UDP packet, saved by pflog, is decoded incorrectly as ATALK.

tcpdump output:

# tcpdump -r packet.pcap 
reading from file packet.pcap, link-type PFLOG (OpenBSD pflog file)
11:22:11.296532 IP 115.61.0.254 > 143.12.228.91: at-#100 5

whereas the (presumably correct) wireshark output:

Frame 1: 110 bytes on wire (880 bits), 110 bytes captured (880 bits)
PF Log IPv4 pass on ifc by rule 0
Internet Protocol Version 4, Src: 172.30.0.11 (172.30.0.11), Dst: 193.120.212.22 (193.120.212.22)
User Datagram Protocol, Src Port: 55573 (55573), Dst Port: 16605 (16605)
Data (18 bytes)

How-To-Repeat: openssl base64 -d > packet.pcap << EOF
1MOyoQIABAAAAAAAAAAAAHQAAAB1AAAAAwsGUVSGBABuAAAAbgAAAD0CAABpZmMA
AAAAAAAAAAAAAAAAYW5jaG9yX25hbWUAAAAAAAAAABwAAAAC/////6CGAQAAAAAA
ggUAAAEAAABFAAAuAABAAEAR+QasHgALwXjUFtkVQN0AGrhGUxUCmI8Mcz3kAFv+
ZGyAi27Z
EOF

tcpdump -r packet.pcap
Comment 1 Gleb Smirnoff freebsd_committer freebsd_triage 2013-01-30 10:15:11 UTC 
Was this packet recorded on FreeBSD or on OpenBSD system?

-- 
Totus tuus, Glebius.
Comment 2 Dmitry Dvoinikov 2013-02-02 07:01:46 UTC 
> Was this packet recorded on FreeBSD or on OpenBSD system?
> 
> -- 
> Totus tuus, Glebius.

It's all on the same machine, FreeBSD 8.3 as per uname.
Comment 3 Gleb Smirnoff freebsd_committer freebsd_triage 2013-02-07 09:09:50 UTC 
Responsible Changed
From-To: freebsd-bugs->glebius

I'll look at this once I have time.
Comment 4 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 07:58:28 UTC 
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped
Comment 5 Tom Jones freebsd_committer freebsd_triage 2020-07-11 18:51:52 UTC 
Unable to reproduce on 13-CURRENT. If this issue persists feel free to either reopen this bug or to create one with upstream.