Wireshark · Ethereal-users: [Ethereal-users] Packet crashes Ethereal

["McNutt, Justin M." <McNuttJ@xxxxxxxxxxxx>]

Hey all,

I've got this telnet packet that makes ethereal (and tethereal) hang when trying to decode it.  Thanks to editcap, I was able to show that it is this packet and only this packet that is creating the problem (attached).

Thoughts?
 
Here is what tcpdump thinks of it (rather long):

[root@dnps-linux1 tmp]# tcpdump -SnvvvxX -r thatfile3
06:40:07.002264 128.206.197.22.4454 > 24.90.234.111.23: . [tcp sum ok] 3385378122:3385379502(1380) ack 1373909 win 15540 (DF) (ttl 126, id 61508, len 1420)
0x0000   4500 058c f044 4000 7e06 be78 80ce c516     E....D@.~..x....
0x0010   185a ea6f 1166 0017 c9c8 c54a 0014 f6d5     .Z.o.f.....J....
0x0020   5010 3cb4 bb23 0000 2f44 3b64 0b53 5275     P.<..#../D;d.SRu
0x0030   7622 2f7e db08 c555 1237 f6bb 712f 7224     v"/~...U.7..q/r$
0x0040   9a86 bdbf c1ff 9b90 4af5 4b7d d2a1 d0ad     ........J.K}....
0x0050   4ccf 17c5 8482 f2ae 5055 62e7 ae8e cbf0     L.......PUb.....
0x0060   451f 44a6 050b 0afc 5b06 c73c 9040 1446     E.D.....[..<.@.F
0x0070   917c 54e1 51c5 99e0 ad32 5072 b39a 0693     .|T.Q....2Pr....
0x0080   9e95 8a90 adca f045 4031 c1a0 175b 5ed3     .......E@1...[^.
0x0090   f1c8 3ffd 7344 e19a fc71 5072 15d1 8143     ..?.sD...qPr...C
0x00a0   b013 48c1 c158 0b11 ac42 1ac4 218f 15b7     ..H..X...B..!...
0x00b0   4ff1 d193 f0da 54d1 73c0 e0fe 0381 a1a1     O.....T.s.......
0x00c0   e1e8 2913 004a 9f7a ea5d d208 6854 0f44     ..)..J.z.]..hT.D
0x00d0   44de f3bd 3676 0897 df40 198f 4980 f794     D...6v...@..I...
0x00e0   dab2 878b 539e 565e a81c 153c 4747 ac27     ....S.V^...<GG.'
0x00f0   788c 07ff 6cdf 01fb fc02 f6ed c583 255f     x...l.........%_
0x0100   6efd 73ca 3a7c 51dd 03a1 0118 3955 16fa     n.s.:|Q.....9U..
0x0110   b7e0 647f bb40 d975 5bdf 072a 76b7 e072     ..d..@.u[..*v..r
0x0120   3152 949d 17c5 d30c 1579 94a2 e1f4 78a7     1R.......y....x.
0x0130   0fcf ae98 b41c c064 383a 23cc e3d5 8fe5     .......d8:#.....
0x0140   85ea d551 13f9 0110 f3bf ff7b fff8 b272     ...Q.......{...r
0x0150   20c6 510c 8545 3185 0714 b88d 3ed1 1225     ..Q..E1.....>..%
0x0160   0ce8 8912 d7bd e192 4163 278b 0085 3350     ........Ac'...3P
0x0170   15bc f1f1 1310 590f 8a2b c907 8381 8b27     ......Y..+.....'
0x0180   b014 a158 0b08 e177 c1cc 2784 45d5 bf11     ...X...w..'.E...
0x0190   9e14 ed03 6413 edaa 49f1 85ad d7fa b65c     ....d...I......\
0x01a0   1508 216b 20e4 0367 6f06 02b2 334e a853     ..!k...go...3N.S
0x01b0   c0b9 ad20 90d8 a2fb 68d8 9e57 48c9 61e8     ........h..WH.a.
0x01c0   f415 267b 5cf7 09b9 cf75 a6b8 6eda e8e6     ..&{\....u..n...
0x01d0   d49b 6c93 ed24 e258 2d22 b498 4330 a5f8     ..l..$.X-"..C0..
0x01e0   623c 56d7 7531 cd4b 8328 077c f505 b02f     b<V.u1.K.(.|.../
0x01f0   78c5 9b16 e91c e8e4 b2a0 d5f3 419b c542     x...........A..B
0x0200   a61e 3cad d263 ff2e 6488 5702 e048 b63b     ..<..c..d.W..H.;
0x0210   5b70 aa56 c320 313a fa46 e150 2b5a 8d55     [p.V..1:.F.P+Z.U
0x0220   6a07 5918 2314 d784 7e27 8cc0 2be7 fbf3     j.Y.#...~'..+...
0x0230   3eae 0177 a540 a39d c1b9 df6b bfff 83f4     >..w.@.....k....
0x0240   6fe9 c4fc 357d 3294 c78c 1106 4e11 553b     o...5}2.....N.U;
0x0250   f568 a166 8bd5 4983 d02b a81d 87b0 8b70     .h.f..I..+.....p
0x0260   b71e 3801 0867 eca3 0b1b 9bc9 a755 302c     ..8..g.......U0,
0x0270   13c0 cf1a 0721 315b d4a6 6cef da61 b242     .....!1[..l..a.B
0x0280   6602 d147 e560 6be9 28c1 745e 8823 a37c     f..G.`k.(.t^.#.|
0x0290   ad6c 41a7 59b5 3d3f ffff 3031 7762 5001     .lA.Y.=?..01wbP.
0x02a0   0000 fffb 8444 0c06 4238 2c4c 01e9 32f2     .....D..B8,L..2.
0x02b0   4765 8958 3d86 2048 68a9 372c 3cc0 8110     Ge.X=..Hh.7,<...
0x02c0   94a5 a186 1848 52ac 24d4 12a3 ef34 a964     .....HR.$....4.d
0x02d0   3ea6 5055 1d2c e9a9 1150 fc46 8d59 8393     >.PU.,...P.F.Y..
0x02e0   a311 c3a9 3409 b9c0 a469 79d1 6d64 e72e     ....4....iy.md..
0x02f0   0926 a1e6 2619 0000 0867 13d1 1e0b 9248     .&..&....g.....H
0x0300   8816 1ce0 929e 9191 4614 c28b 2b40 c8ce     ........F...+@..
0x0310   624d 0c95 922c ab7f b04a d8c5 5145 d2d9     bM...,...J..QE..
0x0320   1234 82ed 8ae6 7b4b 933d 937f a7b1 b9fa     .4....{K.=......
0x0330   4d9b 3494 e086 fb2a bbdb bfbb 5361 603f     M.4....*....Sa`?
0x0340   8045 9204 113a 592f 6745 2e87 ac8e d0e2     .E...:Y/gE......
0x0350   367b 9a85 167a ddb0 8d96 f772 9d54 9876     6{...z.....r.T.v
0x0360   c172 4f50 ff11 fb31 51a5 d9df d145 3d36     .rOP...1Q....E=6
0x0370   194f 19e7 270c 4141 2bcc 82ce 0fda 4353     .O..'.AA+.....CS
0x0380   f004 0fa8 1aa8 f4ef 8010 b477 306a a0eb     ...........w0j..
0x0390   23b4 1469 34e6 628f 2d77 4c69 e5bd add3     #..i4.b.-wLi....
0x03a0   e74c 1d59 73a6 4bdc 1bb6 ef7e 89e9 5d02     .L.Ys.K....~..].
0x03b0   a337 70d4 2973 ef9b a1a0 a181 08e6 9832     .7p.)s.........2
0x03c0   1d45 bfa1 4f00 0000 7015 82b4 9990 74c3     .E..O...p.....t.
0x03d0   6a82 8ae8 8e0d 8f28 f83a 4ea2 6474 e2cf     j......(.:N.dt..
0x03e0   20d2 3a60 7aed 7176 b73c c355 78f0 1982     ..:`z.qv.<.Ux...
0x03f0   a3de 3030 6463 350a 0000 47ce d77f f7cd     ..00dc5...G.....
0x0400   8090 8d55 fad3 a917 170f 2357 fcf3 2c58     ...U......#W..,X
0x0410   4c03 7543 b53f d807 3228 d5d9 fa28 6255     L.uC.?..2(...(bU
0x0420   9a64 71ab 5267 2236 d7c4 8779 1849 da65     .dq.Rg"6...y.I.e
0x0430   97ff 541b 55a9 43ff 1ddf e017 ffff e05e     ..T.U.C........^
0x0440   e683 49b6 e387 7591 880b 1ae2 0c1b bd96     ..I...u.........
0x0450   1433 a490 ce04 ef14 79c4 cd30 0136 ee31     .3......y..0.6.1
0x0460   f698 cba4 4db6 266c 5803 97ff 42a4 a895     ....M.&lX...B...
0x0470   ab54 fe49 681d ff50 cd28 77db 8119 9738     .T.Ih..P.(w....8
0x0480   581d e858 6b8b 519f 6b5e b3c0 a9bd a9ea     X..Xk.Q.k^......
0x0490   a8b9 28a7 a057 9cc5 b598 8e9b 23c1 1814     ..(..W......#...
0x04a0   40ed 411b ebf5 ba05 e9b8 b752 8686 dbbe     @.A........R....
0x04b0   ad08 4bf1 3577 fe9a ffbd dff6 bbeb 7244     ..K.5w........rD
0x04c0   4db2 380c 8432 ab6f 9943 a1ae 1a22 572a     M.8..2.o.C..."W*
0x04d0   cce9 8a16 4115 27b8 4619 68b1 419a e25e     ....A.'.F.h.A..^
0x04e0   1e17 845e ad96 74ec 6535 6c6c 4d2b 70e8     ...^..t.e5llM+p.
0x04f0   b554 478b 3092 98fc ff53 08dc 032c 0d4b     .TG.0....S...,.K
0x0500   95af e11f dd40 d811 34d3 4604 2453 74c7     .....@..4.F.$St.
0x0510   afff 144d 6d5e 22be a54f 6d96 ce7f f8ee     ...Mm^"..Om.....
0x0520   e1bb fff2 e869 108b 0585 0e48 ae13 0855     .....i.....H...U
0x0530   6d8f b01c 955c 1183 308a 867d d0c0 b241     m....\..0..}...A
0x0540   79d3 628f 0472 2565 fdfa 9c11 c774 0c01     y.b..r%e.....t..
0x0550   7200 42ef 590c 19ab c8d2 6245 111a 1af4     r.B.Y.....bE....
0x0560   0513 ffff fffa 32c1 a8c8 167f e069 18ce     ......2......i..
0x0570   fdb5 1ce0 395b 2f14 0a98 2616 1e08 4785     ....9[/...&...G.
0x0580   d1f3 205d 551a 5aea aae5 4da2               ...]U.Z...M.

Thanks!

Justin McNutt
Network Systems Analyst
DNPS, Mizzou Telecom
(573) 882-5183

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
        -- Linus Torvalds

 <<BadPacket.pcap>>

Attachment: BadPacket.pcap
Description: BadPacket.pcap