I am working on an RMI problem, and I noticed that the newest
version (CVS, today) of Ethereal does not appear to decode RMI any more.
I tried Linux 0.9.7, and the Windows 0.9.6 binary package. Neither one
lists RMI as the protocol of some of the packets in my trace file. The
0.9.4 version on Linux (which I compiled some time while the version
number was set that way) does show RMI packets in the same trace file.
One packet I looked at was identified as "Serialization data", and
"Version 5".
As i am the author of the RMI dissector, i will answer:
First the RMI dissector will only try to decode packets as RMI,
if they use TCP Port 1099 for communication. After that, it tries
to decode the RMI Message, following the RMI Specification. If it
doesn't get any clues what kind of message it's looking at it will
only show undecoded data or "Continuation".
I just verified, that the released version 0.9.7 does this correct.
I can use the new version of Ethereal to view the same packet, and it >shows as a TCP packet, and the RMI portion is "Data". The same bytes >that were decoded by 0.9.4 are shown as hex.
Don't think so. There should be no change in the rmi code.
It also depends what traffic you are decoding. For instance,
if you try to decode "RMI" Traffic between jboss and jboss client,
you would only see traffic delared as "Serialisation Data" as jboss uses
something called jnp over the Java RMI Port.
But i can offer you to look at the dumps, if you are able to mail them to
me. (keep it small if possible)
Cheers,
-Michael
