Ethereal-dev: Re: [ethereal-dev] Checked in Wiretap changes to eliminate "ftell()" calls

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 30 Aug 1999 17:30:57 -0700 (PDT)
> It works fine here.
> Are the byte view and packet view correct (including the info column in
> packet view) ?
> 
> Here is an example of what I have for packet no. 223 :

Frame 223 is OK; it's frame 5 that isn't.  (5 is an initial SYN, which
may or may not be relevant.)

The summary display (first pane - is that what you're referring to as
the packet view?) shows

	0.137712  163.78.49.1  163.78.1.1  TCP  4158 > 9010 [SYN] Seq=314048000 Ack=0 Win=4096

so the initial call to "dissect_x25()" recognized it as an IP frame, but
the detail display shows only "Frame", "LAPB", "X.25", and then "Data
(40 bytes)", so the call to "dissect_x25()" for that didn't recognize it
as an IP frame.  The (hex) byte view shows

  0000  03 02 10 04 00 45 00 00  28 7a a6 00 00 1e 06 a9   .....E.. (z...... 
  0010  8b a3 4e 31 01 a3 4e 01  01 10 3e 23 32 12 b7 fe   ..N1..N. ..>#2... 
  0020  00 00 00 00 00 50 02 10  00 e3 1b 00 00            .....P.. ..... 

and if you click on "Data" it selects everything starting with the "45"
on the first row.