Re: [Ethereal-users] Why only 28 bytes captured for any frame???

[Joerg Mayer <jmayer@xxxxxxxxx>]

On Fri, May 02, 2003 at 09:20:19AM -0500, John H. Critchfield Jr. wrote:
> Unknown.  NAI Sniffer and other protocol analyzers decode the entire frame.
> Even when the capture is specified to capture more than the 28 bytes,
> Ethereal does not.  Perhaps some parameter I have not yet located should be
> adjusted.  Any ideas?
> 
> Win 95B , Ethereal 1.3.0 binary - I did not re-compile it, WinPCAP 3.0.

OK, let me summarize:
You have capture files (in sniffer format?) that Ethereal decodes incorrectly
in the current version. Earlier versions decoded it correctly. I dont't think
there ever was a version 1.3.0 of Ethereal, but that's not the problem right
now :-) My problem is, that I can't reproduce your problem. Can you please
send a capture file with a few frames that show the problem? You can send it
either to the list or - in case it contains sensitive data - to me personally.

Thanks

   Jörg

--
Joerg Mayer                                           <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.