First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Error to display multicast packet

Hello,

Thanks to supply wireshark.

My device transmit data as source port 5101 ~ 5108 in UDP. And destination port 5100, and support Multicast packet 60001 ~ 60008.

This is normal packet.

image good status

My device send data such as normal packet image. 5104 : transmit to 5100 and 60004 5102 : transmit to 5100 and 60003 (transmit from one source port to two destination port(5100 and multicast port(60001 ~ 60008)

But, wireshark doesn't display some multicast packets.

image bad status

But, sometimes doesn't display(capture) multicast packet such as error packet image.

So, wireshark display is good after click "Restart current capture".

This symptom occurs often.

I upload the log file in share folder. https://drive.google.com/drive/folder...

ZMG-390_Log.pcapng Normal operation is until line 948. My device pause to transmit data. and restart. Wireshark is no capture multicast packet after line 949.

This file is after "Restart current capture". ZMG-390_Log_restart.pcapng

Thanks.

Best regards, Baek.

v3.4.4 and v3.4.5 are same conditions.

jobaek's avatar
1
jobaek
asked 2021-04-27 00:19:51 +0000
grahamb's avatar
23.8k
grahamb
updated 2021-04-28 20:09:33 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Can you give more detail about what the error is? (What is the difference between the screenshots?)

Chuckc's avatar Chuckc (2021-04-27 14:40:55 +0000) edit

Thanks for comment.

My device send data such as normal packet image. 5104 : transmit to 5100 and 60004 5102 : transmit to 5100 and 60003 (transmit from one source port to two destination port(5100 and multicast port(60001 ~ 60008) But, sometimes doesn't display multicast packet such as error packet image. When this situation, I click "Restart current capture" and it is recovery.

jobaek's avatar jobaek (2021-04-27 15:02:12 +0000) edit

Thanks for the explanation. Can you provide a capture file that has this issue?

Chuckc's avatar Chuckc (2021-04-27 15:18:15 +0000) edit

okay. I will capture the receive packets at tomorrow. and I will upload it.

jobaek's avatar jobaek (2021-04-27 15:20:11 +0000) edit

Is this post analysis or live analysis? What I found is permit Wireshark to finish whatever it doing before trying a new one. Wireshark doesn''t crash or complain, but the results will be skewed.

BigFatCat's avatar BigFatCat (2021-04-27 17:14:38 +0000) edit
add a comment see more comments

1 Answer

0

Hi, I see in the ZMG-390_Log.pcapng capture after packet 948, the next multicast packet is 976 approximately 23.493sec later. Did you notice that is when Wireshark starts reporting IPv4 checksum errors and IPv6 multicast packets? Wireshark believes this could "IP checksum offload". The other file doesn't have IPv4 checksum errors or IPv6. Filter for IPv4 checksum is "ip.checksum_bad.expert"

BigFatCat's avatar
31
BigFatCat
answered 2021-04-28 11:31:51 +0000, updated 2021-04-28 11:54:05 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer