Ethereal-dev: Re: [Ethereal-dev] time packet shows up as a malformed TFTP packet in ethereal 0

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>
Date: Fri, 3 Dec 2004 10:40:04 -0800 (PST)
On Fri, 3 Dec 2004, Guy Harris wrote:

> Dale Schaafsma wrote:
>
> >  I've attached a small ethereal capture file (5 packets) where packet#1
> > shows as a "Malformed Packet: TFTP" in the packet details portion of the
> > window. This seems to me to be a result of the tftp request using the
> > same src port in packet#5
>
> It is.  The problem is that the TFTP dissector uses a mechanism inside
> Ethereal to set up a "conversation", so that all traffic after the
> initial TCP request be recognized as such, but there's currently no way
> to specify the first packet in the conversation, so it thinks packets
> that appear *before* the first TFTP packet are part of the conversation
> and are thus TFTP.

Oh dear, that was my first dissector ...

> This will probably be fixed at some point.  I can't say when it'll be fixed.

Perhaps that should be my PUNISHMENT :-)

Regards
-----
Richard Sharpe, rsharpe[at]richardsharpe.com, rsharpe[at]samba.org,
sharpe[at]ethereal.com, http://www.richardsharpe.com