Ethereal-users: Re: [Ethereal-users] GRE [Malformed Frame]

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Tue, 10 Jul 2001 14:16:22 -0700 (PDT)
> I am using V0.8.18, WinPcap 2.1,  on a WIN2K Server acting as a VPN router.
> Whenever I capture packets on the "external" NIC (connected to the internet
> via SDSL) all of the GRE packets show "Encapsulated PPP [Malformed Frame] in
> the Info column of the capture display.  VPN is working properly between the
> two sites.

This means that the dissector is trying to dissect data past the end of
the frame.

This could mean that

	1) the frame was not put correctly on the wire;

	2) the frame is part of a fragmented IP datagram (GRE runs
	   inside IP, so if a GRE-encapsulated frame, plus the GRE
	   header, plus the IP header, plus the link-layer header, is
	   larger than the maximum frame size of the medium on which the
	   packet is being transmitted, the frame will be fragmented);

	3) there's a bug in some dissector;

	4) some other problem exists.

To eliminate problem 2), try

	selecting the "Preferences" item from the "Edit" menu;

	selecting the "IP" tab in the dialog box that pops up;

	turning the "Reassemble fragmented IP datagrams" option on (this
	isn't a Windows-style checkbox, in the default GTK+ theme in
	that version of GTK+, so "on" is indented rather than checked);

	click "OK";

Ethereal should then reassemble fragmented IP datagrams.

If the frames are still reported as malformed, we'd have to see the
capture in order to see what the problem is.