This is an incorrect paket, the "Application Reply Size" sould be zero and
not 9 as you point out.
So yes this is an icorrectly constructed packet.
-----Original Message-----
From: Guy Harris [mailto:gharris@xxxxxxxxx]
Sent: den 12 juni 2003 02:23
To: Joakim Wiberg
Cc: ethereal-dev@xxxxxxxxxxxx
Subject: Re: [Ethereal-dev] Dissector for EtherNet/IP
On Wed, Jun 11, 2003 at 03:38:54PM -0700, Guy Harris wrote:
> OK, I've checked that version in - with some fixes to get rid of other
> compiler warnings (such as a "possibly uninitialized variable" warning
> due to the code checking whether there's additional command data,
> constructing a subtree if there is, and then adding to that subtree
> whether there was additional command data or not - I changed it to move
> all that code under the "is there additional command data?" check).
>
> You should probably get the updated version from anonymous CVS, and sent
> all subsequent updates as patches to that version, rather than as the
> entire source file.
By the way, the dissector (both the checked-in version, and the previous
version, without the changes in question) shows frame 49 of your sample
capture as a "Malformed Packet" - that packet shows an "Application
Reply Size" of 0x09 in the command-specific data of the second item in
the top-level command-specific data, but there isn't any application
reply data in the packet.
Is that packet, in fact, incorrectly constructed?
