diff options
author | Jeff Morriss <jeff.morriss.ws@gmail.com> | 2012-07-25 20:27:46 +0000 |
---|---|---|
committer | Jeff Morriss <jeff.morriss.ws@gmail.com> | 2012-07-25 20:27:46 +0000 |
commit | beef3c0791e582c1d63b8836a9d03bf2cf045546 (patch) | |
tree | 5a5dcbb4343d4c82fa066201cb980c50246ed960 /colorfilters | |
parent | 30cb0749916fed9677944fd7d2b9bb7573406ce8 (diff) |
From Stephen Donnelly via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7500 :
The default colorfilter for "Bad Checksum" does not include the Ethernet Frame
Check Sequence (FCS) test.
It seems reasonable that it should be included in this filter rule. It is only
indicated if the Ethernet dissector "Validate the Ethernet checksum if
possible" preference is set and the FCS is believed to be present (via wiretap
heuristic/dissector preference).
From me: re-order the list of bad checksum fields.
svn path=/trunk/; revision=44010
Diffstat (limited to 'colorfilters')
-rw-r--r-- | colorfilters | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/colorfilters b/colorfilters index 649ab77034..5a63371556 100644 --- a/colorfilters +++ b/colorfilters @@ -9,7 +9,7 @@ @TCP RST@tcp.flags.reset eq 1@[37008,0,0][65535,63121,32911] @SCTP ABORT@sctp.chunk_type eq ABORT@[37008,0,0][65535,63121,32911] @TTL low or unexpected@( ! ip.dst == 224.0.0.0/4 && ip.ttl < 5 && !pim) || (ip.dst == 224.0.0.0/24 && ip.ttl != 1)@[37008,0,0][65535,65535,65535] -@Checksum Errors@cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1 || sctp.checksum_bad==1 || mstp.checksum_bad==1@[0,0,0][65535,24383,24383] +@Checksum Errors@eth.fcs_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1 || sctp.checksum_bad==1 || mstp.checksum_bad==1 || cdp.checksum_bad==1 || edp.checksum_bad==1@[0,0,0][65535,24383,24383] @SMB@smb || nbss || nbns || nbipx || ipxsap || netbios@[65534,64008,39339][0,0,0] @HTTP@http || tcp.port == 80@[36107,65535,32590][0,0,0] @IPX@ipx || spx@[65534,58325,58808][0,0,0] |