Ethereal-dev: Re: [ethereal-dev] Ethereal showing extra data on the end of packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Timothy Babin" <tbabin@xxxxxxxxxxxxxxxxxx>
Date: Fri, 09 Jul 1999 10:13:04 -0500
Gilbert Ramirez wrote:
> 
> On Fri, Jul 09, 1999 at 09:49:40AM -0500, Timothy Babin wrote:
> >
> >
> > I am trying to debug a problem with ethereal showing
> > extra information on the end of packets.
> >
> > I am capturing ICMP packets with both ethereal and tcpdump.
> > tcpdump correctly shows me the shortened packets, but
> > ethereal shows me extra garbage on the end.
> >
> > Any ideas?
> 
> Can you post a small sample trace so others can load it into
> ethereal?
> 
> What OS and NIC are you using? It is possible that you are seeing
> a link-layer checksum on the end.
> 
> --gilbert

Here is the tcpdump capture file and the ethereal capture file on the same
empty icmp packet.

If I load the tcpdump capture file into ethereal with modification to the 
dissect_icmp to check capture length, ethereal does fine. 
If I capture or read a file captured by ethereal, garbage is packed on
the end.

Redhat 5.2(kernel 2.0.36)
ethereal 0.6.2
gtk 1.0.6


Not exactly sure what the NIC is?
Does it make a difference if the pcap lib is used for both captures?


-- 
Timothy P. Babin              972-685-4976 
GSM Automation                ESN 445-4976 
tbabin@xxxxxxxxxxxxxxxxxx 
------------------------------------------ 
 
Incompetence knows no barriers of time or place. 
 
                           --  Laurance J. Peter
Ôò¡DÛ?7´2<< dp@¢þ.^Eͼ?5/ѧO/Ñ£ÿ¦[ªEý¬ºPà¥
nd_i
Ôò¡DÛ?7´2""¢þdSÀðÿÿEͼ@5/ѧO/Ñ£