Ethereal-users: Re: [Ethereal-users] TDS + Lotus

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 09 Dec 2004 12:40:36 -0800
Marshal V Langlois wrote:

Ethereal appears to identify some of my lotus notes traffic as TDS... is this correct? Or is it a bug of some sort?
Ultimately, it might be an inherent weakness of all network analyzers. 
Many protocols have a field in them that specifies the protocol type of 
the payload of the protocol - for example, Ethernet has a type/length 
field, and if it's a length field, there's an 802.2 header with service 
access points and, if both service access points are 0xAA, there's a 
SNAP header with an OUI and a protocol ID.
TCP and UDP are *not* protocols that have a protocol type field.  They 
just have port numbers, but not all protocols have standard port 
numbers, and even "well-known" and "registered" ports might be used for 
protocols other than the one that "belongs" to them.
Therefore, there's no guarantee that a network analyzer will correctly 
identify the protocol used by TCP or UDP traffic - it can't do so.  It 
can try to guess whether a packet is for a particular protocol, by 
looking at it, and either
	reject packets using the port for a given protocol if they don't look 
like packets for that protocol
or

accept packets for a given protocol if they look like packets for that protocol.
Ethereal's TDS dissector, in the current version of Ethereal (0.10.7 - 
if you're using an earlier version, try updating) accepts as TDS packets 
TCP packets to or from ports 1433 and 2433, without checking whether 
they look like TDS packets, and also accepts as TDS packets any TCP 
packets that weren't claimed by another protocol's dissector and that 
look like TDS packets - or that are part of a connection in which one of 
the latter type of packets was seen.  "Look like" involves checking 
whether it looks like a login packet; if it does, the entire TCP 
connection is treated as TDS.
Is the Lotus Notes traffic you're seeing on ports 1433 or 2433?