aboutsummaryrefslogtreecommitdiffstats
path: root/colorfilters
diff options
context:
space:
mode:
authorJeff Morriss <jeff.morriss.ws@gmail.com>2012-07-25 20:27:46 +0000
committerJeff Morriss <jeff.morriss.ws@gmail.com>2012-07-25 20:27:46 +0000
commitbeef3c0791e582c1d63b8836a9d03bf2cf045546 (patch)
tree5a5dcbb4343d4c82fa066201cb980c50246ed960 /colorfilters
parent30cb0749916fed9677944fd7d2b9bb7573406ce8 (diff)
From Stephen Donnelly via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7500 :
The default colorfilter for "Bad Checksum" does not include the Ethernet Frame Check Sequence (FCS) test. It seems reasonable that it should be included in this filter rule. It is only indicated if the Ethernet dissector "Validate the Ethernet checksum if possible" preference is set and the FCS is believed to be present (via wiretap heuristic/dissector preference). From me: re-order the list of bad checksum fields. svn path=/trunk/; revision=44010
Diffstat (limited to 'colorfilters')
-rw-r--r--colorfilters2
1 files changed, 1 insertions, 1 deletions
diff --git a/colorfilters b/colorfilters
index 649ab77..5a63371 100644
--- a/colorfilters
+++ b/colorfilters
@@ -9,7 +9,7 @@
@TCP RST@tcp.flags.reset eq 1@[37008,0,0][65535,63121,32911]
@SCTP ABORT@sctp.chunk_type eq ABORT@[37008,0,0][65535,63121,32911]
@TTL low or unexpected@( ! ip.dst == 224.0.0.0/4 && ip.ttl < 5 && !pim) || (ip.dst == 224.0.0.0/24 && ip.ttl != 1)@[37008,0,0][65535,65535,65535]
-@Checksum Errors@cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1 || sctp.checksum_bad==1 || mstp.checksum_bad==1@[0,0,0][65535,24383,24383]
+@Checksum Errors@eth.fcs_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1 || sctp.checksum_bad==1 || mstp.checksum_bad==1 || cdp.checksum_bad==1 || edp.checksum_bad==1@[0,0,0][65535,24383,24383]
@SMB@smb || nbss || nbns || nbipx || ipxsap || netbios@[65534,64008,39339][0,0,0]
@HTTP@http || tcp.port == 80@[36107,65535,32590][0,0,0]
@IPX@ipx || spx@[65534,58325,58808][0,0,0]