Ethereal-dev: Re: [Ethereal-dev] NLM decode problem Ethereal vs. Sniffer Pro

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>
Date: Wed, 22 Jan 2003 18:37:43 +1100
NLM decoding in NetMon and Sniffer is known to be suboptimal.

For NLM, goto Edit/Preferences/Protocols/NLM and enable 
ethereal to keep track of request/response matching for async NLM
and see what we do normally and none else can do.

Maybe they have hardcoded the offset of where NLM starts into the packet 
and get confused by some header being too unexpectedly long.


----- Original Message ----- 
From: "Dr. Uwe Girlich" 
Sent: Wednesday, January 22, 2003 6:23 PM
Subject: [Ethereal-dev] NLM decode problem Ethereal vs. Sniffer Pro


> Hello!
> 
> I just got my hands on a NLMv4 trace file (NFS3 lock manager).
> 
> Interesting is packet 10 (NLMv4 UNLOCK reply, XID 574db2a6):
> Ethereal decodes NLM beginning at offset 0x52 and Sniffer Pro 4.50.04 is
> reported to decode NLM data beginning at offset 0x4e, which is totally
> incorrect. Can anyone with this Sniffer version try it out?
> 
> But anyway, here we have another NLM test pattern file.
> 
> Bye, Uwe
> 
>