Ethereal-users: Re: [Ethereal-users] rsync protocol: probably a dumb question...

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 4 Aug 2003 02:02:06 -0700
On Sat, Aug 02, 2003 at 12:26:22AM +0100, Alan Burlison wrote:
> I'm trying to figure out why rsync is failing, and I've been using etheral
> to watch the traffic between the client & server.  I notice a lot of the
> RSYNC protocol packets are tagged with [short frame].  What exactly does
> that mean?

It *usually* means that a capture was done with a snapshot length less
than the length of some packets, in which case you'll see it happen in a
packet where the "bytes captured" value in the "Frame N" entry in the
second (protocol tree) pane is less than the "bytes on wire" value.

> I've read the stuff in the FAQ about various OS/NIC cards that 
> don't work properly in promiscuous mode, but I don't think that applies here 
> as I'm running ethereal on one of the end-point machines, and it is running 
> Solaris.  The packets marked as being short *do* have a payload that 
> contails a list of recognisable file names.  Does the [short frame] 
> indicator mean that the rsync data stream is being unexpectedly fragmented?

If an RSYNC packet is split across TCP segments, it should show a
"Malformed Packet" or "Unreassembled Packet" indication, not a "Short
Frame" indication.  If you have an example of a capture where it's
showing up as "Short Frame" and the frame does *not* have a "bytes
captured" value less than the "bytes on wire" value, we'd like to see
the capture to try to figure out why Ethereal's doing that.