THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Dissector bug protocol sip

Wireshark is throwing dissector bug, protocol SIP: error as shown below. This happens for a sip message from Ericsson containerized P-CSCF towards IMS core. Looks like Ericsson container P-CSCF has added some tags after Branch Tag in Via header. Wireshark is unable to handle that. I already checked sip protocol options but there is nothing that can be done from user interface to ignore the additional tags. Can someone help on a workaround for the dissector bug.

 Session Initiation Protocol
    Request-Line: REGISTER sip:msg.lab.t-mobile.com SIP/2.0
    Message Header
        Via: SIP/2.0/UDP 10.xxx.xxx.xxx:5060;branch=z9hG4bKg3Zqkv7iiuu5d9cb2gyyeore6tohdm87j;eric_th_id=1;be-route=MTkyLjE2OC43Ny42MDo4MDgw
            Transport: UDP
            Sent-by Address: 10.xxx.xxx.xxx
            Sent-by port: 5060
            Branch: z9hG4bKg3Zqkv7iiuu5d9cb2gyyeore6tohdm87j
            **eric_th_id=1
            be-route: MTkyLjE2OC43Ny42MDo4MDgw**
[Dissector bug, protocol SIP: C:\gitlab-builds\builds\MsQ3pox2\0\wireshark\wireshark\epan\packet.c:3456: failed assertion "handle != ((void *)0)"]
    [Expert Info (Error/Malformed): C:\gitlab-builds\builds\MsQ3pox2\0\wireshark\wireshark\epan\packet.c:3456: failed assertion "handle != ((void *)0)"]
        [C:\gitlab-builds\builds\MsQ3pox2\0\wireshark\wireshark\epan\packet.c:3456: failed assertion "handle != ((void *)0)"]
        [Severity level: Error]
        [Group: Malformed]
cruzneel's avatar
1
cruzneel
asked 2024-07-27 23:57:39 +0000
Chuckc's avatar
3k
Chuckc
updated 2024-07-28 03:28:45 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Please update the question with the output of wireshark -v or Help->About Wireshark:Wireshark.
It helps to have a sample capture file. Can you put one on a public file share then update the question with a link to it.

Chuckc's avatar Chuckc (2024-07-28 04:23:43 +0000) edit
add a comment see more comments

1 Answer

0

The proper channel to report this to be fixed is in our GitLab project. Filling out all fields of the issue template and attaching a sample capture file to it allows to address this, perhaps before the next stable release comes out.

Jaap's avatar
13.7k
Jaap
answered 2024-07-28 05:33:20 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer