[Guy Harris <guy@xxxxxxxxxxxx>]

On Sat, Aug 02, 2003 at 12:26:22AM +0100, Alan Burlison wrote:
> I'm trying to figure out why rsync is failing, and I've been using etheral
> to watch the traffic between the client & server.  I notice a lot of the
> RSYNC protocol packets are tagged with [short frame].  What exactly does
> that mean?

It *usually* means that a capture was done with a snapshot length less
than the length of some packets, in which case you'll see it happen in a
packet where the "bytes captured" value in the "Frame N" entry in the
second (protocol tree) pane is less than the "bytes on wire" value.

> I've read the stuff in the FAQ about various OS/NIC cards that 
> don't work properly in promiscuous mode, but I don't think that applies here 
> as I'm running ethereal on one of the end-point machines, and it is running 
> Solaris.  The packets marked as being short *do* have a payload that 
> contails a list of recognisable file names.  Does the [short frame] 
> indicator mean that the rsync data stream is being unexpectedly fragmented?

If an RSYNC packet is split across TCP segments, it should show a
"Malformed Packet" or "Unreassembled Packet" indication, not a "Short
Frame" indication.  If you have an example of a capture where it's
showing up as "Short Frame" and the frame does *not* have a "bytes
captured" value less than the "bytes on wire" value, we'd like to see
the capture to try to figure out why Ethereal's doing that.