Ethereal-users: [Ethereal-users] Ethereal 0.9.0: Reporting 'Malformed Frame: SKINNY'

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Ron Flory <ron.flory@xxxxxxxxxx>
Date: Thu, 31 Jan 2002 08:13:33 -0600
hi-

 My apologies if this has already been reported and addressed.

 While monitoring a raw TCP stream (telnet protocol, but the server is on
port 2000 on an embedded device) ethereal often reports it is seeing SKINNY
frames.  This only appears to happen on frames 60-bytes in length, or less
(probably due to the 64-byte ethernet minimum).

 Ethereal is reporting SKINNY frames for those sent by the 'other' machine
as well as the local Linux system.  Both machines are correctly 'padding'
all ether frames out to the required 64 byte minimum.  My guess is that
ethereal is being fooled by the Linux network drivers, which may be
stripping the padd bytes at time of reception, and the dissector is seeing
what it thinks are runt frames.

 An older version of ethereal (0.8.12 on an x86 Linux 2.2.18 machine ) does
not exhibit this 'feature'.

 Ethereal 0.9.0
 Linux x86 2.4.17 (RedHat 7.1+ based)
 glibc 1.2.9
 libpcap 0.4
 SMC-Ultra network card (module)

 Thanks-

ron