Ethereal-dev: [Ethereal-dev] Small oddity in ENIP in 0.9.15

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: jfielding@xxxxxxxxxxxxxxx
Date: Sat, 4 Oct 2003 15:14:03 +0100

I was very pleased when ENIP was added a couple of versions ago. I'd been printing to text, then running a series of horribly complicated scripts to do a partial dissection. I couldn't easily put together the environment to build Ethereal, so it was a great relief when someone else did the dissector!

This bug happens in an unconnected send when MR size is odd, so there's a pad byte after the Message Request. The dissector thinks the pad byte is the last byte of the MR data, and is out by one byte till the end of the message.

There's an example in the attachment Odd.eth (I use Windows and manually associate .eth with Ethereal. Command line "C:\Program Files\Ethereal\Ethereal.exe" "%1" works fine). Expand frame 10 until you can see "Message Request Size: 0x0009". Select the following Message Request and the correct 9 bytes are highlighted. Note the last byte is 42. Now select Pad Byte and notice that it's the same byte.

The correct dissection should be: Pad Byte 0, Route Path Size 1, Reserved 0, Route Path 1,5. (That is port 1, link id 5.)

The actual message is silly, I put it together just for test. Frame 11 has a correct error response.

Julian.

Attachment: Odd.eth
Description: Binary data