Ethereal-users: Re: [Ethereal-users] Malformed frame

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 26 Dec 2001 13:47:04 -0800
On Wed, Dec 26, 2001 at 10:48:21AM -0500, Dror Heller wrote:
> Can somebody tell me what's wrong with the following DHCP message?

Not without seeing the packet's raw data.  There's probably some option
in the packet that's shorter than it's supposed to be - or, at least,
shorter than Ethereal thinks it should be, either because

	1) the option really *is* shorter than it's supposed to be

or

	2) the Ethereal DHCP/BOOTP dissector is incorrect.

You can use "editcap" to write just that frame to a new file, or can
mark the frame and select "Save only marked packets" in Ethereal's "Save
As" dialog box to write just that frame to a new file, and then send the
file with that frame to me or to the list.