Re: [Ethereal-dev] time packet shows up as a malformed TFTP packet in ethereal 0.10.7

[Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>]

On Fri, 3 Dec 2004, Guy Harris wrote:

> Dale Schaafsma wrote:
>
> >  I've attached a small ethereal capture file (5 packets) where packet#1
> > shows as a "Malformed Packet: TFTP" in the packet details portion of the
> > window. This seems to me to be a result of the tftp request using the
> > same src port in packet#5
>
> It is.  The problem is that the TFTP dissector uses a mechanism inside
> Ethereal to set up a "conversation", so that all traffic after the
> initial TCP request be recognized as such, but there's currently no way
> to specify the first packet in the conversation, so it thinks packets
> that appear *before* the first TFTP packet are part of the conversation
> and are thus TFTP.

Oh dear, that was my first dissector ...

> This will probably be fixed at some point.  I can't say when it'll be fixed.

Perhaps that should be my PUNISHMENT :-)

Regards
-----
Richard Sharpe, rsharpe[at]richardsharpe.com, rsharpe[at]samba.org,
sharpe[at]ethereal.com, http://www.richardsharpe.com