Ethereal-dev: Re: [Ethereal-dev] time packet shows up as a malformed TFTP packet in ethereal 0

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 03 Dec 2004 02:33:25 -0800
Dale Schaafsma wrote:
I've attached a small ethereal capture file (5 packets) where packet#1 shows as a "Malformed Packet: TFTP" in the packet details portion of the window. This seems to me to be a result of the tftp request using the same src port in packet#5
It is. The problem is that the TFTP dissector uses a mechanism inside Ethereal to set up a "conversation", so that all traffic after the initial TCP request be recognized as such, but there's currently no way to specify the first packet in the conversation, so it thinks packets that appear *before* the first TFTP packet are part of the conversation and are thus TFTP. 

This will probably be fixed at some point.  I can't say when it'll be fixed.