Ethereal-dev: Re: [ethereal-dev] NFS filename / RPC string bug

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Uwe Girlich <Uwe.Girlich@xxxxxxxxxxx>
Date: Mon, 6 Dec 1999 07:45:31 +0100
On Fri, Dec 03, 1999 at 02:15:37PM -0800, Guy Harris wrote:
> > I've been using Ethereal today specifically to debug strange NFS problem
> > at work. I thought there might be some VFS bug in the Linux kernel, but it
> > didn't even dawn on my to consider malformed packets!
It is definitely a malformed packet.

> Cf. my earlier comment, in another mail thread, on how one reason for
> using Ethereal is to check for packets that *aren't* following the rules
> of their protocol, and hence the requirement that Ethereal not assume
> all packets are valid....
dissect_rpc_string() tries it best and interprets the first 4 bytes as the
length field. There aren't so many bytes in frame any more but what we have
left, will be printed. I just program a better dissect_rpc_string(), which
makes sure, that <TRUNCATED> appears also in these cases. It wasn't printed in
your version, because the string contained a \0 byte already, and the
<TRUNCATED> string came only after the end of the whole string.

Uwe