wireshart shows wrong information

[Peter Lambrechtsen]

On Mon, Apr 29, 2013 at 12:14 AM, Alan DeKok <aland at deployingradius.com> wrote:
> Juan Pablo L. wrote:
>> Alan, can you please extend a little bot more ... what do you mean that
>> you see the correct value .... i see value "f3 08 48 12" when i m
>> actually expecting "00000001" ..... i really dont see where it is
>> actually correct. ... thanks!!!
>
>   In the debug log *I* see, it has the correct value.
>
>   In the pcap file *I* see, it has the correct value.
>
>   You're still not being specific.  You see a bad value.  OK... where?
> In what file?  In what packet of what file?  Which version of FreeRADIUS
> are you using?
>
>   You keep waving your hands and saying "something is wrong".  I keep
> asking you for details, and you keep saying "something is wrong".  You
> don't understand that those details are *important*.  You seem to
> believe that if you repeat yourself long enough, I'll understand.
>
>   Well, I won't.  I'm asking for those details because I need those
> details.  When you refuse (repeatedly) to provide those details, it
> makes me likely to start ignoring your messages.
>
>   If you can't be bothered to describe what's happening, I can't be
> bothered to help you.

I assume that the OP has updated the radius dictionary file in
Wireshark if any changes were made to the FreeRadius dictionary?

It's under the "radius" directory under the main install of Wireshark
that needs to have the exact same changes you made (if you made any
changes to your FreeRadius dictionary files) to be made in Wireshark.
Plus it may depend on the version of Wireshark you're running, if it's
old it is sure to be out of date.

That would determine if Wireshark correctly decodes the values or not.