Ethereal-users: Re: [Ethereal-users] Short Frame message

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 7 Nov 2003 14:58:23 -0800

On Nov 7, 2003, at 7:43 AM, Dinesh Radhakrishnan wrote:


Making H323 calls from Win 2000 box to Win XP box.

No network Hub, and straight IP call.

I get all Q931 packets but they are marked as "Short Frame".
In the "Frame" line in the protocol tree pane (the middle pane of the display), is "bytes on wire" greater than "bytes captured"? 

If so, the frames really are short, presumably because either

	1) you captured with the "Limit each packet to [N] bytes" option

or
2) WinPcap is erring or some piece of software on your box is getting in WinPcap's way.
If not, do you have the TCP preference "Allow subdissector to desegment TCP streams" and the TPKT preference "Desegment all TPKT messages spanning multiple TCP segments" turned on? If not, try turning on whichever of them are turned off.