ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-users: Re: [Ethereal-users] Newbie, WinNT4 errors when capturing packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Tue, 5 Feb 2002 13:45:12 -0800 (PST)
> I am new to network protocol analyzers and I am trying to get the hang
> of Ethereal.  I am able to capture packets but after a little while I
> receive an error "Unable to use XML, Diameter, bad packet or version"

That's not *an* error, it's two *separate* errors in two *separate*
error messages - and neither of them are fatal error messages, they're
just warnings.

One error is

	Diameter: Using static dictionary! (Unable to use XML)

which means that there's no version of libxml available (or installed)
for Windows.  (I have nothing to do with libxml, so people shouldn't ask
me anything about getting libxml for Windows.)

That merely means that the dissector in Ethereal for the Diameter
protocol won't be able to read XML files describing the Diameter
protocol, so the dissector will use a hardcoded dictionary instead, and
might not be able to symbolically dissect all of the protocol.

If you're not using the Diameter protocol on your network, or you don't
know what Diameter is, don't worry, be happy.

The other error is

	Diameter: Bad packet: Bad Flags(0xXXXX) or Version(YYY)

for some values of "XXXX" and "YYY"; that error means that a packet to
or from TCP port 1812 (the port for the Diameter protocol) had a flags
or version field that wasn't valid in a Diameter packet, perhaps because
the packet *wasn't* a Diameter packet.

If you're not using the Diameter protocol on your network, or you don't
know what Diameter is, don't worry, be happy.

> Since I get this error I am unable to load the capture and review it.

What happens if you try to load the capture? If it prints warnings but
still displays the packets, then you *are* able to load it, you're just
not able to do so without warnings.  If the only problem is the warning
messages, don't worry, be happy.