clifffrey/tcpdump — comment on commit a71e402b5cd71b5a609dc9d2f8c234d4c3c0bf34
File:  line 0
By clifffrey:

Sadly, I cannot. All of my test equipment here only produces "defined"
Network Policy elements. I have seen this on a customer visit, and I don't
feel comfortable sharing their packets, however, here is an edited excerpt
from current tcpdump (without my patch) from a Polycom phone, where you can
see it is claiming that the polycom phone is setting the reserved bit, when
in fact it is setting the "Undefined" bit.

LLDP, length 389
Chassis ID TLV (1), length 6
Subtype Network address (5): AFI IPv4 (1):
Port ID TLV (2), length 7
Subtype MAC address (3)
Time to Live TLV (3), length 2: TTL 120s
0x0000: 0078
Port Description TLV (4), length 1: 1
0x0000: 31
System Name TLV (5), length 25: Polycom SoundPoint IP 550
0x0000: 506f 6c79 636f 6d20 536f 756e 6450 6f69
0x0010: 6e74 2049 5020 3535 30
...
Organization specific TLV (127), length 8: OUI ANSI/TIA (0x0012bb)
Network policy Subtype (2)
Application type [voice] (0x01), Flags [*reserved*]
Vlan id 0, L2 priority 5, DSCP value 46
0x0000: 0012 bb02 0180 016e

also, wireshark correctly defines the "undefined" bit as the high-order
bit, as shown below

wireshark: epan/dissectors/packet-lldp.c
/* Unknown policy flag */
if (tree)
proto_tree_add_text(tree, tvb, tempOffset, 2, "%s",

decode_boolean_bitfield(tempShort, *0x8000*, 16,"Policy: Unknown", "Policy:
Defined"));

On Thu, Feb 23, 2012 at 5:14 PM, Michael Richardson <
reply@reply.github.com
> wrote:

> Can you send a packet (pcap) that shows the correct bit definitions in the
> output?
> Thanks.
>
> ---
> Reply to this email directly or view it on GitHub:
>
> https://github.com/clifffrey/tcpdump/commit/a71e402b5cd71b5a609dc9d2f8c234d4c3c0bf34#commitcomment-1005264
>