Wireshark · Ethereal-users: [Ethereal-users] TCP stream shows different stuff?

[Damir Cosic <damir@xxxxxxxxxxxxxx>]

Hi everybody,

I captured an FTP session, which consists of several ls commands, which,
in turn, consist of a PORT and a LIST command. First few commands are
OK. and then server starts responding to PORT commands with:

500 '': command not understood

However, the regular list view in ethereal doesn't show any difference
between good and bad PORT packets. But TCP Stream from Tools menu
displays something completely different. Good packets look the same in
both views, but for bad packets TCP Stream view prints some garbage:

  0 Feb 13 20:02 bussys

preceded with two new lines. If this is true, that would explain why my
PORT commands don't work, but my question is to whom I can believe and
why do they display different stuff.

I would greatly appreciate if you could CC me, because I am not
subscribed.  Thanks.


Damir