Wireshark-bugs: [Wireshark-bugs] [Bug 9950] MDSSVC: New DCE/RPC service dissector for Apple's Sp
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sat, 05 Apr 2014 07:00:51 +0000

changed bug 9950

What Removed Added
Status RESOLVED INCOMPLETE
Resolution FIXED ---
Ever confirmed   1

Comment # 12 on bug 9950 from 
Michael,

thanks for your help and the improved AFP dissector integration!

Unfortunately, with your changes, the Spotlight dissector has issue causing
"long frame" warning when used from the new MDSSVC RPC code. This doesn't
happen when dissecting AFP.

RPC requests always show "long frame (28 bytes)", RPC replies show "long frame
(64 bytes)". The amount of bytes is the same for all packets. Attached pcap
demonstrates the effect. Dissection of the Spotlight blob is correct, it just
seems to return a too small offset so dissection of elements after that fail.

This wasn't happening with my origin patches.

I've started inspecting the code with your patches, but nothing obvious seems
wrong. Especially since the AFP dissector still works, I wonder where things go
wrong. I'll attach an AFP packet capture with a small Spotlight search, you can
filter it with

afp.command == 76

You are receiving this mail because:
  • You are watching all bug changes.