How to decode a packet received through WireShark & resolving some errors

Hamra Rehan picture Hamra Rehan · Feb 15, 2013 · Viewed 17.9k times · Source

We are capturing traffic using JN5148EK010 nodes via WireShark. The packets received are shown in the screenshot provided.

  1. I want to know how to decode the data
  2. An error occurs afer capturing a few packets, whose screen shot is also provided. How to resolve this error?
  3. List item

Another error (please refer to third screenshot) occured.

How to resolve that?

enter image description here enter image description here

enter image description here

Answer

willyo picture willyo · Feb 16, 2013

A quick web search suggests that Wireshark is being used with customized plugins (provided by Jennic ?).

The string "Jennic Sniffer protocol" is not found in the current Wireshark sources which suggests strongly that a customized version of Wireshark is being used.

So: i suspect you'll need to consult with the vendor and/or the vendor documentation (which I note discusses various configuration preferences).


In any case, it's basically impossible to say much without being able to analyze the actual capture; based only on the screen shots I'll just say the following.

The expert window says "We don't support encryption with protocol [version ?]"

Does that refer to the frame 322 that you've highlighted. If so, the message means just what it says (assuming that the attempted dissection is valid).

The "malformed" messages mean that the dissector(s) are unable to make sense of the data.

Bigger picture: Given the various "malformeds"and the warning about decryption not being supported, anything is possible...

Again, your best approach might be to consult with the vendor.