On Sun, Jun 18, 2000 at 02:53:37AM -0500, Guy Harris wrote:
>
>
> The filter, as per your mail to me, was
>
> frame[54] == 47:49:4f:50
>
> (i.e., checking for GIOP packets) - and every single frame in the
> capture has those four bytes at an offset of 54, even the payload-less
> TCP and ARP packets!
>
> The payload-less TCP and ARP packets don't *really* have that much data
> in them; however, they're padded to 60 bytes to the minimum Ethernet
> frame size, and the padding data appears to include "GIOP" at an offset
> of 54 bytes (perhaps because that was what was in the OS network buffer
> used for that packet the previous time it was used, and because the OS
> just leaves whatever junk was there previously as Ethernet padding).
>
> As per my response to your mail, if you want to restrict the display to
> GIOP packets, a filter of just "giop" works.
Yes, there is a bug; the display filter code is not checking the length
of the packet. I'll provide a patch.
--gilbert