https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7622
Summary: [Malformed Packet: TDS] DONE token breakout has wrong
length
Product: Wireshark
Version: 1.8.1
Platform: x86
OS/Version: Windows XP
Status: NEW
Severity: Normal
Priority: Low
Component: Dissection engine (libwireshark)
AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
ReportedBy: david.sandman@xxxxxxxxxx
Created attachment 8944
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=8944
exported the packets for file > export. did a range of 12 - 15
Build Information:
Version 1.8.1 (SVN Rev 43946 from /trunk-1.8)
Copyright 1998-2012 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (32-bit) with GTK+ 2.24.10, with Cairo 1.10.2, with Pango 1.30.0, with
GLib 2.32.2, with WinPcap (4_1_2), with libz 1.2.5, without POSIX capabilities,
with SMI 0.4.8, with c-ares 1.7.1, with Lua 5.1, without Python, with GnuTLS
2.12.18, with Gcrypt 1.4.6, with MIT Kerberos, with GeoIP, with PortAudio
V19-devel (built Jul 23 2012), with AirPcap.
Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1
beta5
(packet.dll version 4.1.0.1452), based on libpcap version 1.0.0, GnuTLS
2.12.18,
Gcrypt 1.4.6, without AirPcap.
Built using Microsoft Visual C++ 10.0 build 40219
Wireshark is Open Source Software released under the GNU General Public
License.
Check the man page and http://www.wireshark.org for more information.
--
DoneRowCount should be 8 Bytes long as of TDS 7.2
>From specification [MS-TDS].pdf
DoneRowCount = LONG / ULONGLONG; (Changed to ULONGLONG in TDS 7.2)
This is in the response (04) to the login request in clear text
I addeded an attachment of a file > export of a a range of packets that show
the pre-login request, response, login request, response(Malformed)
There is a SQL Server version field in the login ACK token in the same packet
that might be used to determine TDS version. The actual TDSVersion is in the
pre-login if you can retain that data for subsequent packet breakouts.
Thankx
David Sandman
Load Test Engineering Consultant
BCBS of SC
Incase you can not read that, here is a copy/past of the displayed packet
0000 00 23 ae b1 67 27 00 21 d8 b7 c0 40 08 00 45 00 .#..g'.! [email protected].
0010 01 f5 38 4a 40 00 7c 06 a7 8a 0a b4 ff 39 0a 1e ..8J@.|. .....9..
0020 09 23 05 99 0e 94 cd 6e 30 a7 70 24 f2 7a 50 18 .#.....n 0.p$.zP.
0030 f9 da 01 47 00 00 04 01 01 cd 00 36 01 00 e3 17 ...G.... ...6....
0040 00 01 04 55 00 4e 00 49 00 54 00 06 6d 00 61 00 ...U.N.I .T..m.a.
0050 73 00 74 00 65 00 72 00 ab 8e 00 45 16 00 00 02 s.t.e.r. ...E....
0060 00 23 00 43 00 68 00 61 00 6e 00 67 00 65 00 64 .#.C.h.a .n.g.e.d
0070 00 20 00 64 00 61 00 74 00 61 00 62 00 61 00 73 . .d.a.t .a.b.a.s
0080 00 65 00 20 00 63 00 6f 00 6e 00 74 00 65 00 78 .e. .c.o .n.t.e.x
0090 00 74 00 20 00 74 00 6f 00 20 00 27 00 55 00 4e .t. .t.o . .'.U.N
00a0 00 49 00 54 00 27 00 2e 00 1d 41 00 37 00 30 00 .I.T.'.. ..A.7.0.
00b0 54 00 55 00 43 00 4f 00 4d 00 50 00 41 00 59 00 T.U.C.O. M.P.A.Y.
00c0 44 00 30 00 30 00 31 00 5c 00 55 00 43 00 4f 00 D.0.0.1. \.U.C.O.
00d0 4d 00 50 00 41 00 59 00 44 00 30 00 30 00 31 00 M.P.A.Y. D.0.0.1.
00e0 44 00 42 00 00 01 00 00 00 e3 08 00 07 05 09 04 D.B..... ........
00f0 d0 00 34 00 e3 17 00 02 0a 75 00 73 00 5f 00 65 ..4..... .u.s._.e
0100 00 6e 00 67 00 6c 00 69 00 73 00 68 00 00 ab 96 .n.g.l.i .s.h....
0110 00 47 16 00 00 01 00 27 00 43 00 68 00 61 00 6e .G.....' .C.h.a.n
0120 00 67 00 65 00 64 00 20 00 6c 00 61 00 6e 00 67 .g.e.d. .l.a.n.g
0130 00 75 00 61 00 67 00 65 00 20 00 73 00 65 00 74 .u.a.g.e . .s.e.t
0140 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 .t.i.n.g . .t.o.
0150 00 75 00 73 00 5f 00 65 00 6e 00 67 00 6c 00 69 .u.s._.e .n.g.l.i
0160 00 73 00 68 00 2e 00 1d 41 00 37 00 30 00 54 00 .s.h.... A.7.0.T.
0170 55 00 43 00 4f 00 4d 00 50 00 41 00 59 00 44 00 U.C.O.M. P.A.Y.D.
0180 30 00 30 00 31 00 5c 00 55 00 43 00 4f 00 4d 00 0.0.1.\. U.C.O.M.
0190 50 00 41 00 59 00 44 00 30 00 30 00 31 00 44 00 P.A.Y.D. 0.0.1.D.
01a0 42 00 00 01 00 00 00 ad 36 00 01 73 0b 00 03 16 B....... 6..s....
01b0 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 M.i.c.r. o.s.o.f.
01c0 74 00 20 00 53 00 51 00 4c 00 20 00 53 00 65 00 t. .S.Q. L. .S.e.
01d0 72 00 76 00 65 00 72 00 00 00 00 00 0a 32 0a d4 r.v.e.r. .....2..
01e0 e3 13 00 04 04 34 00 30 00 39 00 36 00 04 34 00 .....4.0 .9.6..4.
01f0 30 00 39 00 36 00 fd 00 00 00 00 00 00 00 00 00 0.9.6... ........
0200 00 00 00 ...
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
