Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Packet 0 filled - High NIC utilization

From: "Jim Young" <sysjhy@xxxxxxxxxxxxxxx>
Date: Wed, 23 Jan 2008 16:28:46 -0500
Hello Daniel,

>>> "Daniel Koepke" <dkoepke@xxxxxxxxxxxxxxxxxxx> 01/23/08 3:26 PM >>>
> It seems that when a PC makes the connection to the server and request a file. 
> The file is sent to the workstation, but the packet scans show the data segment 
> is padded with 0's. The packets are full size 1460 bytes and sent multiple packet 
> before the ACK. It appears that we run through this cycle of requesting the file 
> and getting 0 data. If we stop the PC or disable the switch port, the problem 
> seems to move to another PC.  Have not been able to define any patterns 
> on PC or network segments

This is a stab in the dark, but perhaps you have a "sparse file".   Sparse 
files are not intended to be read sequentially.  If you do try to read a sparse 
file sequentially you can find yourself transferring many megabytes (or I 
guess today it could be perhaps in the gigabytes) of data in excess of what 
the server actually has as real storage!   When read, all of the "sparse" data 
will contain 0's.

A couple of sites that have some info on sparse files include:

  http://www.jrbsoftware.com/jrbutils_nw/utils/utils5.htm

  http://www.euronet.nl/users/rovabu/wvw/sparse.html

For more sites google for words: netware sparse files

There used to be some Netware based command line tool (nlist?, ndir?) that 
one could use to determine (indirectly) when a file was sparse.  If I recall 
correctly you would have to compare the size of the file as reported by a 
directory listing to the amount of the storage actually consumed on the file 
server.  

In our case virtually every sparse file we found was generated by an errant
program.  Unfortunatly it used to be trivally easy to create one.

Hope this helps.

Jim Y.