First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Need to increase TWAMP MBZ integer to 2 Bytes

  • retag add tags

twamp.test.mbz1 MBZ Unsigned integer (1 byte)

Is there any way to edit this filter to support 2 byte field? Routers will insert values greater than 255.

brebelo's avatar
1
brebelo
asked 2023-01-23 18:23:16 +0000
edit flag offensive 0 remove flag close merge delete

Comments

On Cisco routers, MBZ field is 16 bits

brebelo's avatar brebelo (2023-01-23 20:35:33 +0000) edit

"MBZ" stands for "Must Be Zero"; the only value an MBZ value can have is zero (which is less than 255...), so either this field is not an MBZ field, and its value may have some significance, or those routers have buggy firmware/oftware.

Guy Harris's avatar Guy Harris (2023-01-24 07:22:59 +0000) edit

MBZ needs to be corrected and reworded to Session ID. I suppose this is an interpretation of Wireshark which is not correct.

brebelo's avatar brebelo (2023-01-24 16:39:27 +0000) edit

RFC 5357 shows the fields as MBZ.

Chuckc's avatar Chuckc (2023-01-24 16:42:43 +0000) edit

In Cisco's implementation, the MBZ field is the Session-ID. Without it, the control plane would not be able to differentiate between sessions. All TWAMP sessions originated in the router use the same UDP socket.

I can let the MIG BU know about this RFC discrepancy and get their feedback.

brebelo's avatar brebelo (2023-01-24 17:09:31 +0000) edit
add a comment see more comments

1 Answer

0

9592: twamp: test mbz fields are FT_UINT16

Update: this has been merged into the main/master branch.

To test on Windows or Mac, download an automated build or download the source and build on other platforms. (Wireshark-win64-4.1.0rc0-1553-g06fc6483b38f or newer build).

Example capture file is attached to 16264: TWAMP dissector not working.

Chuckc's avatar
3k
Chuckc
answered 2023-01-24 02:22:34 +0000, updated 2023-01-24 16:25:54 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer