Wireshark-users: [Wireshark-users] NCP Protocol Info field
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Gerry McCafferty <gmccaff@xxxxxxxxxxx>
Date: Thu, 6 Sep 2007 10:42:36 +1000

Quick question about the Info fields of ncp.ndsverb == 0x1 fields (NDS Resolve Name) in Wireshark 0.99.6a in Windows XP.

If it is a servername, then for some reason the fully qualified name (e.g. \T=TREE\O=OU\CN=SERVER) is appended with a string similar to ?\?wp ?w???????wj?0g then after that there are another 5 characters that differ with each packet, but at least one is a double-byte ASCII character of a square with four 0 in it (like when you try and display Chinese characters without the correct fonts).

I know that this is cosmetic, but this didn't appear in Ethereal 0.99.0 loaded on the same machine from my memory. Any idea why this is happening?

Regards,

Gerry McCafferty
Server Support
IBM Global Services A/NZ