On Wednesday, September 3, 2003, at 12:08 PM, Distribution Lists wrote:
I'm seeing a fair amount of short frame during some LDAP binds/search.
What are short frames
The consequence of either
1) when capturing, specifying a "snapshot length" not large enough to
capture the entire packet;
2) possibly not enabling LDAP-over-TCP reassembly (although those
should show up as something other than a "Short Frame", e.g. "Malformed
Packet" or "Unreassembled Packet");
3) some weird interaction between some VPN/etc. drivers on Windows and
WinPcap, that causes an effect similar to 1);
4) some bug in Ethereal.
At the beginning of the detailed view of each packet it should say
something such as
Frame N (M bytes on wire, P bytes captured)
If P is less than M, it's either 1) or 3).
If it's neither 1) nor 3), then select "Preferences" from the Edit
menu, open up the "Protocols" list in the Preferences dialog box,
select "LDAP", and make sure that "Desegment all LDAP messages spanning
multiple TCP segments" is turned on. If it's not, turn it on, and
click "OK".
If that makes the problem go away, it's 2). If it doesn't make the
problem go away, it's 4).
and are they hindering performance ?
They don't represent any real behavior on the wire, they represent an
artifact of the way the packets are being captured or dissected by
Ethereal.
I can send the trace in text...but its verbose
A binary version of the trace would be better. If the problem is 4)
rather than 1), 2), or 3), send us that.