Ethereal-dev: [Ethereal-dev] Re: Ethereal WebSphere MQ dissection on segmented message

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: metatech <metatech@xxxxxxxxxxxxx>
Date: Sat, 21 Jan 2006 15:23:15 +0100
At 21:46 18/01/2006 +0100, e.soden-mls@xxxxxxxxxxx wrote:
> I m using WebSphere MQ dissector built within ethereal 0.10.14. I ve made a simple test send 256K using application segmentation. I split a 256K into 31,5K segment.
> I get some trouble to see MQ packet in ethereal:
> - First packet (MESSAGE_DATA) is displayed correctly in the packet list pane. But nothing appears in the packet details pane.
>  - Last MESSAGE_DATA is displayed correctly.
> - All MESSAGE_DATA between first and last packet are dissected as TCP segment of a reassembled PDU and I get for each of them a TCP ACKed lost segment .
> What happened there? Somebody could explain what happens?
> I attach to this mail a capture file to test it and a small png file showing the behavior.

Hi Manu,

From the capture file it appears that you were capturing on localhost with a maximum Ethernet packet size of about 16K, although the largest packet in the transmission is about 32K.
Please restart the capture with a maximum packet size of at least 32K.
Since the packets are not complete, the MQ dissector is confused when it tries to desegment/reassemble the packets. You can see that if you disable the two levels of reassembly in the preferences of the MQ dissector. All the MESSAGE_DATA packets are larger than 16K, except the last one. This is the reason why the last packet is displayed properly in the pane.
Please let me know if this completely fixes your problem.

Cheers,

metatech