Ethereal-dev: [Ethereal-dev] RE: rpc-over-tcp alignment patch

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Eric Wedel" <ewedel@xxxxxxxxxxx>
Date: Tue, 2 Aug 2005 22:07:49 -0700
Hi again..
 
Just noticed that I'd left a questionable bit of silliness in the new preference's
description field.  This patch tidies that, but is otherwise the same.
 
Comments and/or checkin appreciated.  This patch is against 0.10.12, so
should apply easily.
 
thanks, Eric
 
-----Original Message-----
From: Eric Wedel
Sent: Monday, August 01, 2005 6:14 PM
To: 'ethereal-dev@xxxxxxxxxxxx'
Subject: rpc-over-tcp alignment patch

Hi..
 
Recently we had a few pathological NFS captures come in from the field.
The RFC 1831 section 10 marking facility is being used to the max, with
records starting pretty much anywhere in a PDU.
 
What made these especially fun to decode is that they occurred in partial
captures, where the alignment could not be determined.
 
The attached patch adds an option to the RPC dissector to permit detection
of embedded message fragments.  It only works for replies at present, but
then that's all we saw (so all I could test easily).
 
Could somebody please take a look at the patch, and check it in if ok?
[Unfortunately, the captures contain customer data, etc. etc. 
If we do get some publishable captures I could post them to the list.]
 
thanks,
Eric Wedel, BlueArc Engineering
 

Attachment: rpc-frag-finder2.patch
Description: rpc-frag-finder2.patch