Ethereal-users: Re: [ethereal-users] Buglet in Ethereal 0.8.9

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Gilbert Ramirez <gram@xxxxxxxxxx>
Date: Mon, 19 Jun 2000 11:13:05 -0500
On Sun, Jun 18, 2000 at 02:53:37AM -0500, Guy Harris wrote:
> 
> 
> The filter, as per your mail to me, was
> 
>         frame[54] == 47:49:4f:50
> 
> (i.e., checking for GIOP packets) - and every single frame in the
> capture has those four bytes at an offset of 54, even the payload-less
> TCP and ARP packets!
> 
> The payload-less TCP and ARP packets don't *really* have that much data
> in them; however, they're padded to 60 bytes to the minimum Ethernet
> frame size, and the padding data appears to include "GIOP" at an offset
> of 54 bytes (perhaps because that was what was in the OS network buffer
> used for that packet the previous time it was used, and because the OS
> just leaves whatever junk was there previously as Ethernet padding).
> 
> As per my response to your mail, if you want to restrict the display to
> GIOP packets, a filter of just "giop" works.

Yes, there is a bug; the display filter code is not checking the length
of the packet. I'll provide a patch.

--gilbert