Ethereal-users: Re: [Ethereal-users] [Short Frame] 578 byte

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "TR Naidu" <reddaiah.tellapati@xxxxxxxxxx>
Date: Tue, 24 Aug 2004 18:26:38 +0530
Title: [Short Frame] 578 byte
Hi,
  I believe it is something ip fragmentation.If your system is sending the SETUP/ALERTING in more than one fragment, since ethereal displays multiple fragments of same message seperately it says SETUP (short frame).You find the remaining message as different fragment.
 
thanks and regards,
TR Naidu.
 
 
 
 
----- Original Message -----
Sent: Tuesday, August 24, 2004 2:39 PM
Subject: [Ethereal-users] [Short Frame] 578 byte

Hallo,

I am analysing H323 trafic with ethereal 0.10.5.
However,  lot of messages are decoded just as Q931 SETUP [Short Frame] or Q931 ALERTING [Short Frame]
According to the ethereal there are always " 578 bytes on wire, 578 bytes captured" in this case.

It is unlikely that all these messages are of the same length (578 bytes), though they can be certainly very huge (over 10000 bytes) because they contain tunneled ISDN messages with a lot of features.

Other H323 messages ,shorter than 578 bytes, are decoded well.

Does anyone know what is this magical 578 bytes limit?

I have not activated the "Limit each packet to.." option.

Thank you for reading my mail.

Lajos Morvai

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users