[Guy Harris <guy@xxxxxxxxxxxx>]

On Mon, Aug 04, 2003 at 07:55:51PM +0100, Alan Burlison wrote:
> > If an RSYNC packet is split across TCP segments, it should show a
> > "Malformed Packet" or "Unreassembled Packet" indication, not a "Short
> > Frame" indication.  If you have an example of a capture where it's
> > showing up as "Short Frame" and the frame does *not* have a "bytes
> > captured" value less than the "bytes on wire" value, we'd like to see
> > the capture to try to figure out why Ethereal's doing that.
> 
> Here is a selection of frames showing the problem

There was a bug when a zero-length string appeared in some packets; I've
checked in a fix.

However, it appears that the capture you sent has the middle of an RSYNC
sequence, but not the beginning of the connection, and, unfortunately, I
don't think Ethereal's RSYNC dissector can handle that, so, if you have
started the capture in the middle of an RSYNC sequence, you will
probably only be able to make sense out of that capture by manually
decoding the raw hex data in the TCP segments - Ethereal's dissection
will probably not be correct, even with the bug fix, so don't infer from
it that the RSYNC session is necessarily invalid.

I don't know when that'll be fixed, if it's even fixable; I'm not an
RSYNC expert, and won't be working on that.  (The bug I referred to in
the first paragraph was a generic bug, not a bug in the RSYNC
dissector.)