Ethereal-dev: Re: [Ethereal-dev] ETHEREAL bug in handling TR1 file format

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>
Date: Thu, 26 Jun 2003 09:15:17 -0700 (PDT)
On Thu, 26 Jun 2003, Rostislav Letos wrote:

> I know the old LANalyzer included FCS bytes here, but according to 
> official TR1 file format documentation, this variable should keep length 
> of stored packet data.
>
> So I would clasify this as a bug in ETHEREAL.
> 
> The correct handling here should be to determine available packet data 
> length by comparing this stored value with length counted from packet 
> record (0x1005, record length-32bytes). This way you can avoid cutting 4 
> bytes from the packet in case exact packet length is stored there.
> 
> Can you please fix it in ETHEREAL ?
> TR1 files generated by our NETMON for NetWare can be easily handled by 
> LANalyzer or Sniffer, but not by your ETHEREAL.

Could you send us an example capture please so we can see what the 
problems are and fix them? It is awefully hard to do so based on someone 
else's description.

Regards
-----
Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, 
sharpe[at]ethereal.com, http://www.richardsharpe.com