Wireshark · Ethereal-users: Re: [ethereal-users] Buglet in Ethereal 0.8.9

[Gilbert Ramirez <gram@xxxxxxxxxx>]

On Sun, Jun 18, 2000 at 02:53:37AM -0500, Guy Harris wrote:
> 
> 
> The payload-less TCP and ARP packets don't *really* have that much data
> in them; however, they're padded to 60 bytes to the minimum Ethernet
> frame size, and the padding data appears to include "GIOP" at an offset
> of 54 bytes (perhaps because that was what was in the OS network buffer
> used for that packet the previous time it was used, and because the OS
> just leaves whatever junk was there previously as Ethernet padding).
> 
> As per my response to your mail, if you want to restrict the display to
> GIOP packets, a filter of just "giop" works.

Hmm, at first I thought this was a display filter bug (because I knew of
something related in the display filter code). But I see what you're
talking about, somehow your capturing facility saved 60 bytes of data,
no matter what.

On what OS did you make this capture? And what tool did you use
to make the capture. I see it's a libpcap capture... what version of
libpcap are you using?

thanks,

--gilbert