Ethereal-users: [Ethereal-users] Possible SNA decode problem
Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.
Date: Wed, 24 Jul 2002 09:21:49 +0100
Hi everybody I have been having some problems trying to decode some SNA, eventually reverted to using the clunky old sniffer and found that the sniffer decode did not match the ethereal decode. The problem seems to revolve around BIU's that are split into multiple frames. from http://www.protocols.com/pbook/sna.htm When the SNA frame is too large to be sent as one frame, it is divided into several segments (first, middle, last or whole). The first segment includes a TH (indicating that it is the first), an RH and the beginning of the RU. Other segments (middle and last) contain a TH (identical to the one of the first except for the MPF field) and the remainder of the RU. This snippet of a trace shows that this frame is the last segment of a BIU but a phantom RH has been decoded from the following SNA data. Systems Network Architecture Transmission Header Transmission Header Byte 0: 0x24 0010 .... = Format Identifer: Subarea Node <--> PU2 (0x02) .... 01.. = Mapping Field: Last segment of a BIU (1) .... ..0. = ODAI Assignment Indicator: 0 .... ...0 = Expedited Flow Indicator: Normal Flow (0) Reserved Destination Address Field: 0x39 Origin Address Field: 0x01 Sequence Number Field: 258 Request/Response Header Request/Response Header Byte 0: 0xc7 1... .... = Request/Response Indicator: Response (1) .10. .... = Request/Response Unit Category: Data Flow Control .... 0... = Format Indicator: No FM Header .... .1.. = Sense Data Included: Included .... ..1. = Begin Chain Indicator: First in Chain .... ...1 = End Chain Indicator: Last in Chain Request/Response Header Byte 1: 0xf1 1... .... = Definite Response 1 Indicator: True ..1. .... = Definite Response 2 Indicator: True ...1 .... = Response Type Indicator: Negative .... ..0. = Queued Response Indicator: Response bypasses TC queues .... ...1 = Pacing Indicator: True Request/Response Header Byte 2: 0x4b Thanks in advance Nick ----------------------------------------------------------------------- Registered Office: Marks & Spencer p.l.c Michael House, Baker Street, London, W1U 8EP Registered No. 214436 in England and Wales. Telephone (020) 7935 4422 Facsimile (020) 7487 2670 www.marksandspencer.com Please note that electronic mail may be monitored. This e-mail is confidential. If you received it by mistake, please let us know and then delete it from your system; you should not copy, disclose, or distribute its contents to anyone nor act in reliance on this e-mail, as this is prohibited and may be unlawful. The registered office of Marks and Spencer Financial Services Limited, Marks and Spencer Unit Trust Management Limited, Marks and Spencer Life Assurance Limited and Marks and Spencer Savings and Investments Limited is Kings Meadow, Chester, CH99 9FB.
- Prev by Date: Re: [Ethereal-users] Question
- Next by Date: [Ethereal-users] Capture Filters for Ethereal on Windows
- Previous by thread: Re: [Ethereal-users] ethereal 0.9.4-0.7.2.0 crash on Red Hat Linux 7.2
- Next by thread: [Ethereal-users] Capture Filters for Ethereal on Windows
- Index(es):