Wireshark-users: [Wireshark-users] A bug of NFS analyzer(version 0.99.6a for windows)?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Sync ma" <sync.jma@xxxxxxxxx>
Date: Wed, 25 Jul 2007 10:23:55 +0800
I am confused about the nfs packets, please take a look at frame
137,138,139,140.

frame 137 was a NFS Lookup call, request
libuClibc-0.9.28.so(DH=0x0794a104), in frame 138,139,140 wireshark
print the FH as 0x0794a104(same with the DH).

I have tested the same pcap file in 0.99.5 on RHEL5, and it works
correctly(maybe not, at least it shows a different FH value to DH).

BTW: for the same frame 137:

DH value was 0x1bfc5524 in 0.99.5 on RHEL5
DH value was 0x0794a104 in 0.99.6.a on Windows.

both of the versions shows the 'dir/hash' value(copy bytes(hex offset)) :

0000   01 00 00 01 00 fd 00 00 e5 9a 62 00 e7 9a 62 00
0010   04 69 a6 91 00 00 00 00 00 00 00 00 00 00 00 00

Attachment: test2.pcap
Description: Binary data