From 9f27cd56b01db4c45fd5c3de8375b5287f9c72ce Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Mon, 30 Jan 2023 10:59:18 +0100
Subject: ndpiReader: fix packet dissection (CAPWAP and TSO) (#1878)

Fix decapsulation of CAPWAP; we are interested only in "real" user data
tunneled via CAPWAP.
When Tcp Segmentation Offload is enabled in the NIC, the received packet
might have 0 as "ip length" in the IPv4 header
(see
https://osqa-ask.wireshark.org/questions/16279/why-are-the-bytes-00-00-but-wireshark-shows-an-ip-total-length-of-2016/)

The effect of these two bugs was that some packets were discarded.

Be sure that flows order is deterministic
---
 tests/pcap/capwap_data.pcapng | Bin 0 -> 3832 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 tests/pcap/capwap_data.pcapng

(limited to 'tests/pcap')

diff --git a/tests/pcap/capwap_data.pcapng b/tests/pcap/capwap_data.pcapng
new file mode 100644
index 000000000..a302ce0a0
Binary files /dev/null and b/tests/pcap/capwap_data.pcapng differ
-- 
cgit v1.2.3