tshark does not decode the juniper header

Bug #1622498 reported by Shashikiran H
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Juniper Openstack
New
High
prasad miriyala

Bug Description

Topo:
cfgm: nodec22
control: nodec22,nodec26,nodeg10
compute: nodeg8,nodeg14,nodec15 and nodec11

Version: 3.1.0.0-25~mitaka

left-vm------right-vm
        |
        |
      mirror-vm

I send traffic from source vm in source VN to destination vm in destination VM.
I have mirror configuration to mirror all packets from source to destination. Tried with both analyser vm and a ubuntu vm i spawned seperately and tried tshark.

The tshark output from the analyser vm is this:

Frame 4: 142 bytes on wire (1136 bits), 142 bytes captured (1136 bits)
    Arrival Time: Sep 12, 2016 01:13:51.021974000 PDT
    Epoch Time: 1473668031.021974000 seconds
    [Time delta from previous captured frame: 0.000019000 seconds]
    [Time delta from previous displayed frame: 0.000019000 seconds]
    [Time since reference or first frame: 0.000406000 seconds]
    Frame Number: 4
    Frame Length: 142 bytes (1136 bits)
    Capture Length: 142 bytes (1136 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:udp:data]
Ethernet II, Src: IETF-VRRP-VRID_00 (00:00:5e:00:01:00), Dst: 02:87:72:73:fa:d5 (02:87:72:73:fa:d5)
    Destination: 02:87:72:73:fa:d5 (02:87:72:73:fa:d5)
        Address: 02:87:72:73:fa:d5 (02:87:72:73:fa:d5)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
    Source: IETF-VRRP-VRID_00 (00:00:5e:00:01:00)
        Address: IETF-VRRP-VRID_00 (00:00:5e:00:01:00)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 1.1.1.4 (1.1.1.4), Dst: 1.1.1.3 (1.1.1.3)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 128
    Identification: 0x07cd (1997)
    Flags: 0x00
        0... .... = Reserved bit: Not set
        .0.. .... = Don't fragment: Not set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 63
    Protocol: UDP (17)
    Header checksum: 0x6f98 [correct]
        [Good: True]
        [Bad: False]
    Source: 1.1.1.4 (1.1.1.4)
    Destination: 1.1.1.3 (1.1.1.3)
User Datagram Protocol, Src Port: sac (8097), Dst Port: 8099 (8099)
    Source port: sac (8097)
    Destination port: 8099 (8099)
    Length: 108
    Checksum: 0x149f [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Data (100 bytes)

0000 ff 00 02 02 1c ad a0 a9 02 53 7d 75 61 08 08 00 .........S}ua...
0010 45 00 00 54 ae 77 00 00 40 01 c8 27 01 01 01 05 E..T.w..@..'....
0020 01 01 01 04 00 00 1d a6 f3 00 02 52 33 1f b9 e7 ...........R3...
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0060 00 00 00 00 ....
    Data: ff0002021cada0a902537d756108080045000054ae770000...
    [Length: 100]

The header is just displayed as data instead of full header.
The wireshark output from the UI decoded the entire header correctly though.

Tags: analyzer
Shashikiran H (skiranh)
Changed in juniperopenstack:
assignee: nobody → prasad miriyala (pmiriyala)
description: updated
Jeba Paulaiyan (jebap)
tags: added: analyzer
Shashikiran H (skiranh)
information type: Proprietary → Public
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.