Re: [Ethereal-users] Short Frame message

[Guy Harris <guy@xxxxxxxxxxxx>]

On Nov 7, 2003, at 7:43 AM, Dinesh Radhakrishnan wrote:

> Making H323 calls from Win 2000 box to Win XP box.
>
> No network Hub, and straight IP call.
>
> I get all Q931 packets but they are marked as "Short Frame".

In the "Frame" line in the protocol tree pane (the middle pane of the 
display), is "bytes on wire" greater than "bytes captured"?

If so, the frames really are short, presumably because either

	1) you captured with the "Limit each packet to [N] bytes" option

or

	2) WinPcap is erring or some piece of software on your box is getting 
in WinPcap's way.

If not, do you have the TCP preference "Allow subdissector to desegment 
TCP streams" and the TPKT preference "Desegment all TPKT messages 
spanning multiple TCP segments" turned on?  If not, try turning on 
whichever of them are turned off.