How to decode a packet received through WireShark & resolving some errors
Asked Answered
L

2

10

We are capturing traffic using JN5148EK010 nodes via WireShark. The packets received are shown in the screenshot provided.

  1. I want to know how to decode the data
  2. An error occurs afer capturing a few packets, whose screen shot is also provided. How to resolve this error?
  3. List item

Another error (please refer to third screenshot) occured.

How to resolve that?

enter image description here enter image description here

enter image description here

Liquorice answered 15/2, 2013 at 8:41 Comment(1)
related https://mcmap.net/q/1168867/-decoding-sniffed-packetsPricking
D
1

A quick web search suggests that Wireshark is being used with customized plugins (provided by Jennic ?).

The string "Jennic Sniffer protocol" is not found in the current Wireshark sources which suggests strongly that a customized version of Wireshark is being used.

So: i suspect you'll need to consult with the vendor and/or the vendor documentation (which I note discusses various configuration preferences).


In any case, it's basically impossible to say much without being able to analyze the actual capture; based only on the screen shots I'll just say the following.

The expert window says "We don't support encryption with protocol [version ?]"

Does that refer to the frame 322 that you've highlighted. If so, the message means just what it says (assuming that the attempted dissection is valid).

The "malformed" messages mean that the dissector(s) are unable to make sense of the data.

Bigger picture: Given the various "malformeds"and the warning about decryption not being supported, anything is possible...

Again, your best approach might be to consult with the vendor.

Delaminate answered 16/2, 2013 at 15:27 Comment(0)
W
1

Your Wireshark screenshots indicate that you're using Wireshark 1.6.5 (or a customized version based on Wireshark 1.6.5), which is over 5 years old now. According to Wireshark's Lifecycle wiki page, support for Wireshark 1.6 ended on June 7, 2013.

There have been many updates to the IEEE 802.15.4 dissector since then and as such, there's probably a very good chance that the updated dissector dissects the data you're interested in now.

I would recommend that you update your version of Wireshark.

Warman answered 1/2, 2017 at 16:16 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.