Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Packet 0 filled - High NIC utilization

Date Prev · Date Next · Thread Prev · Thread Next
From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Thu, 31 Jan 2008 22:36:36 -0500
Daniel Koepke wrote:

    Maybe this group can add some insight to what is happening with this
    NetWare server
It seems that when a PC makes the connection to the server and
    request a file. The file is sent to the workstation, but the packet
    scans show the data segment is padded with 0's. The packets are full
    size 1460 bytes and sent multiple packet before the ACK. It appears
    that we run through this cycle of requesting the file and getting 0
    data. If we stop the PC or disable the switch port, the problem
    seems to move to another PC.  Have not been able to define any
    patterns on PC or network segments
Can anyone perhaps after reviewing the scan section see anything
    that we could use to isolate the problem or at least be able to
    identify the issues to the vendor.

There's nothing out of the ordinary except that it's padded with zero's. The idea that they may be (accidental) sparse files seems to be the best possible explanation. The path and the name of the file is in the trace, so I would first check with NDIR to see if they are indeed sparse files.

Wow, what a blast from the past. I haven't thought about JRB Utils in YEARS. What a great collection of utilities that was....

--

Thanks,
Hansang