Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] TDS question

From: János Löbb <janos.lobb@xxxxxxxx>
Date: Thu, 6 Oct 2011 13:13:21 -0400
Let me reformulate the question.

If I see a the following TDS_Done packet in Wireshark on my Intel based Macintosh:
> FD 20 00 02 00 16 01 00 00

Then the two bytes  as a 16bit unsigned integer after 'FD', that is the 20 00 is big-, middle- or little-endian?

I am still trying to figure out what hex 2000 means in this case.  Is it really hex 2000 as-big endian or hex 0020 in little-endian ?  Network byte order should be big-endian, but I do not know if Wireshark is presenting it that way on my Intel based Mac.... or not.

Thanks ahead,

János


On Oct 5, 2011, at 4:55 PM, János Löbb wrote:

> Hi,
> 
> I traced TDS /Sybase's Tabulated Data Stream/ traffic because some Infomaker reports are not producing the result they should.  The symptom is the server indicates that the query is finished although it is not.  Let's say from 1000 records it returns only 230.  A consecutive  run returns more data let's say another 300 or so, and so on till all the needed 1000 record is provided.  From there on the report  returns the correct number of records for every consecutive run till the data in the cache on the server is owerwritten.
> 
> According to the Sybase TDS specs,
> http://www.sybase.com/content/1040983/Sybase-tds38-102306.pdf
> 
> the server returns a TDS_DONE /hex FD/ after the transaction is finished followed by Status with 2 bytes and   followed by a two byte TranState.  The manual said this about the Status: " This field is a two-byte, unsigned integer and is a bit field indicating the completion status:
> 
> 0x0000 - TDS_DONE_FINAL	success
> 0x0001 - TDS_DONE_MORE	more records to come
> 0x0002 - TDS_DONE_Error	indicates an error on the current command
> 0x0004 - TDS_DONE_INXACT	transaction is in progress for the current request
> 0x0008 - TDS_DONE_PROC	it is done from a stored procedure
> 0x0010 - TDS_DONE_COUNT		the count argument is valid
> 0x0020 - TDS_DONE_ATTN	acknowledging an Attention command
> 0x0040 - TDS_DONE_EVENT	this done was generated as part of an event notification.
> 
> Here are the hex bytes starting with the TDS_DONE FD in the capture I see:
> 
> FD 20 00 02 00 16 01 00 00
> 
> So the Status is:	20 00
> and the TranState is:	02 00
> 
> So, my question is what these two bytes indicate here ?
> 
> Thanks ahead,
> 
> János
> 
> 
>