Re: [Ethereal-dev] time packet shows up as a malformed TFTP packet in ethereal 0.10.7

[Guy Harris <gharris@xxxxxxxxx>]

Dale Schaafsma wrote:

>  I've attached a small ethereal capture file (5 packets) where packet#1 
> shows as a "Malformed Packet: TFTP" in the packet details portion of the 
> window. This seems to me to be a result of the tftp request using the 
> same src port in packet#5

It is.  The problem is that the TFTP dissector uses a mechanism inside 
Ethereal to set up a "conversation", so that all traffic after the 
initial TCP request be recognized as such, but there's currently no way 
to specify the first packet in the conversation, so it thinks packets 
that appear *before* the first TFTP packet are part of the conversation 
and are thus TFTP.

This will probably be fixed at some point.  I can't say when it'll be fixed.