Wireshark · Ethereal-dev: Re: [ethereal-dev] NFS filename / RPC string bug

[Uwe Girlich <Uwe.Girlich@xxxxxxxxxxx>]

On Fri, Dec 03, 1999 at 02:15:37PM -0800, Guy Harris wrote:
> > I've been using Ethereal today specifically to debug strange NFS problem
> > at work. I thought there might be some VFS bug in the Linux kernel, but it
> > didn't even dawn on my to consider malformed packets!
It is definitely a malformed packet.

> Cf. my earlier comment, in another mail thread, on how one reason for
> using Ethereal is to check for packets that *aren't* following the rules
> of their protocol, and hence the requirement that Ethereal not assume
> all packets are valid....
dissect_rpc_string() tries it best and interprets the first 4 bytes as the
length field. There aren't so many bytes in frame any more but what we have
left, will be printed. I just program a better dissect_rpc_string(), which
makes sure, that <TRUNCATED> appears also in these cases. It wasn't printed in
your version, because the string contained a \0 byte already, and the
<TRUNCATED> string came only after the end of the whole string.

Uwe