Ethereal-users: [Ethereal-users] TCP data being identified as random protocols

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Robert Haynes" <Robert.Haynes@xxxxxxxx>
Date: Wed, 25 Feb 2004 20:22:44 -0500
I'm working on a client-server system whereby the client sends
periodic status messages to the server.  The client communicates
fairly simply, and for every status message, initiates a TCP
connection, sends the message, and closes the connection.  Every
so often (maybe once every 1000 messages) the server doesn't
receive the status message, and when I look at the packet capture,
the "missed" message appears on the network, but is recognized by
Ethereal as various random protocols.  Today one packet was
identified as NDPS with an info line of: "(Continuation Data)
[Unreassembled Packet]".  Several packets have been flagged as
the eDonkey protocol with "eDonkey Continuation" in the Info line
(even though this system runs on a closed network), and I've even
seen the Laplink protocol as well.  Basically Ethereal is recognizing
the data portion of these connections as different protocols instead
of just basic TCP data. The data contents of these status messages
is the exact same every time, and appears so when I look at the
packet body.  Anyone have any idea what may be going on?  I'm
running version 0.9.16 on Win2K SP4, by the way.


Thanks,
Rob Haynes