Wireshark · Ethereal-dev: [Ethereal-dev] rpc-over-tcp alignment patch

["Eric Wedel" <ewedel@xxxxxxxxxxx>]

Hi..

 

Recently we had a few pathological NFS captures come in from the field.

The RFC 1831 section 10 marking facility is being used to the max, with

records starting pretty much anywhere in a PDU.

 

What made these especially fun to decode is that they occurred in partial

captures, where the alignment could not be determined.

 

The attached patch adds an option to the RPC dissector to permit detection

of embedded message fragments.  It only works for replies at present, but

then that's all we saw (so all I could test easily).

 

Could somebody please take a look at the patch, and check it in if ok?

[Unfortunately, the captures contain customer data, etc. etc. 

If we do get some publishable captures I could post them to the list.]

 

thanks,

Eric Wedel, BlueArc Engineering

 

Attachment: rpc-frag-finder.patch
Description: rpc-frag-finder.patch