ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 12307] New: DRDA dissector misses some codepoints

Date: Wed, 30 Mar 2016 09:09:34 +0000
Bug ID 12307
Summary DRDA dissector misses some codepoints
Product Wireshark
Version 1.12.4
Hardware x86
OS Mac OS X 10.10
Status UNCONFIRMED
Severity Major
Priority Low
Component Dissection engine (libwireshark)
Assignee [email protected]
Reporter [email protected]

Created attachment 14452 [details]
pcap to reproduce

Build Information:
Version 1.12.4 (v1.12.4-0-gb4861da from master-1.12)

Copyright 1998-2015 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.17, with Cairo 1.10.2, with Pango 1.30.1, with
GLib 2.36.0, with libpcap, with libz 1.2.3, without POSIX capabilities, with
SMI
0.4.8, without c-ares, without ADNS, with Lua 5.2, without Python, with GnuTLS
2.12.19, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP, with PortAudio
V19-devel (built Jul 16 2013 19:05:52), with AirPcap.

Running on Mac OS X 10.10.5, build 14F1713 (Darwin 14.5.0), with locale .UTF-8,
with libpcap version 1.5.3 - Apple version 47, with libz 1.2.5, GnuTLS 2.12.19,
Gcrypt 1.5.0, without AirPcap.
Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz

Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build
2336.9.00).

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
After capturing some Apache Derby traffic (which also use DRDA) there are some
unknown codepoints in wireshark.

DDM codepoint 0xc000
Parameter codepoint 0x01 (within a SQLSTT DDM)
Parameter codepoint 0xc001(within 0xc000 DDM)
Parameter codepoint 0xc002 (within 0xc000 DDM)
It seems also that wireshark sometimes does not detect parameters within a DDM,
see attachment


You are receiving this mail because:
  • You are watching all bug changes.