Hi,
a few days ago I sniffered ncp packets, which ethereal could not decode.
After looking at different analyzers I found Novell Lanalyzer with the
newest patch, which can decode this packets. Here are my infos perhaps for
the next version of ncp over ip packet decode.
The original hex coded packet:
--------------------------------------------
0000 00 03 47 97 d2 ec 00 20 da e9 39 83 08 00 45 00 ..G.... ..9...E.
0010 00 2a 49 58 00 00 7f 11 d8 6b 0a 5c 0a 36 0a 5c .*IX.....k.\.6.\
0020 fb 11 04 08 02 0c 00 16 9b 11 3e 3e 00 06 00 00 ..........>>....
0030 00 00 06 59 00 00 00 00 37 37 37 37 ...Y....7777
That is what Novell Lanalyzer says about this packet:
----------------------------------------------------------------------------
-
Packet Number : 31 10:25:48
Length : 64 bytes
ether: ==================== Ethernet Datalink Layer ====================
Station: 00-20-DA-E9-39-83 ----> 00-03-47-97-D2-EC
Type: 0x0800 (IP)
ip: ======================= Internet Protocol =======================
Station:10.92.10.54 ---->10.92.251.17
Protocol: UDP
Version: 4
Header Length (32 bit words): 5
Precedence: Routine
Normal Delay, Normal Throughput, Normal Reliability
Total length: 42
Identification: 18776
Fragmentation allowed, Last fragment
Fragment Offset: 0
Time to Live: 127 seconds
Checksum: 0xD86B(Valid)
udp: ===================== User Datagram Protocol ====================
Source Port: 1032
Destination Port: 524
Length = 22
Checksum: 0x9B11(Valid)
ncp: ===================== NetWare Core Protocol =====================
NCP Message: Watchdog Packet
Request Type: 0x3E3E (Watchdog Packet)
Sequence Number: 0
Connection Number Low: 6
Task Number: 0
Connection Number High: 0
Completion Code: 0
Connection Status: 0
Slot: 6
Control Code: 89
Data:
0: 00 00 00 00 |....
And that is what Ethereal 0.9.2 says about this packet:
----------------------------------------------------------------------------
----
Frame 31 (60 on wire, 60 captured)
Arrival Time: May 14, 2002 10:25:48.852695000
Time delta from previous packet: 0.495058000 seconds
Time relative to first packet: 29.166086000 seconds
Frame Number: 31
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II
Destination: 00:03:47:97:d2:ec (Intel_97:d2:ec)
Source: 00:20:da:e9:39:83 (Xylan_e9:39:83)
Type: IP (0x0800)
Trailer: 37373737
Internet Protocol, Src Addr: xxxxx1e3.xxxxx.de (10.92.10.54), Dst Addr:
10.92.251.17 (10.92.251.17)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 42
Identification: 0x4958
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 127
Protocol: UDP (0x11)
Header checksum: 0xd86b (correct)
Source: xxxxx1e3.xxxxx.de (10.92.10.54)
Destination: 10.92.251.17 (10.92.251.17)
User Datagram Protocol, Src Port: iad3 (1032), Dst Port: ncp (524)
Source port: iad3 (1032)
Destination port: ncp (524)
Length: 22
Checksum: 0x9b11 (correct)
NetWare Core Protocol
NCP over IP signature: Unknown (0x3e3e0006)
NCP over IP length: 0x00000000
Type: Unknown (0x0659)
Sequence Number: 0
Connection Number: 0
Task Number: 0
Peter Lieb
Dezentrale Systeme
Tel. +49 6021 633 1420
Fax +49 6021 633 8420
Mail: lieb@xxxxxxxx
