Wireshark · Ethereal-dev: [Ethereal-dev] Re: Ethereal WebSphere MQ dissection on segmented message

[metatech <metatech@xxxxxxxxxxxxx>]

At 21:46 18/01/2006 +0100, e.soden-mls@xxxxxxxxxxx wrote:
> I m using WebSphere MQ dissector built within ethereal 0.10.14. I ve 
made a simple test send 256K using application segmentation. I split a 256K 
into 31,5K segment.
> I get some trouble to see MQ packet in ethereal:
>  - First packet (MESSAGE_DATA) is displayed correctly in the packet list 
pane. But nothing appears in the packet details pane.
>  - Last MESSAGE_DATA is displayed correctly.
>  - All MESSAGE_DATA between first and last packet are dissected as TCP 
segment of a reassembled PDU and I get for each of them a TCP ACKed lost 
segment .
> What happened there? Somebody could explain what happens?
> I attach to this mail a capture file to test it and a small png file 
showing the behavior.

Hi Manu,

From the capture file it appears that you were capturing on localhost with 
a maximum Ethernet packet size of about 16K, although the largest packet in 
the transmission is about 32K.
Please restart the capture with a maximum packet size of at least 32K.
Since the packets are not complete, the MQ dissector is confused when it 
tries to desegment/reassemble the packets.
You can see that if you disable the two levels of reassembly in the 
preferences of the MQ dissector.
All the MESSAGE_DATA packets are larger than 16K, except the last 
one.  This is the reason why the last packet is displayed properly in the pane.
Please let me know if this completely fixes your problem.

Cheers,

metatech