What ethereal version were you using? All three of your captures decode
without error with my fairly recent one.
Ethereal version I used was older one.
Here's the ethereal version I used.
# tethereal -v (RedHat EL3)
tethereal 0.10.8
Compiled with GLib 2.2.3, with libpcap 0.8.3, with libz 1.1.4, without
libpcre,
without UCD-SNMP or Net-SNMP, without ADNS.
NOTE: this build does not support the "matches" operator for Ethereal filter
syntax.
Running with libpcap version 0.8.3 on Linux 2.4.21-32.EL.
I've checked CSS's capture data with newer version ,
there were no messages "malformed packet".
# tethereal -v (CentOS 4.2)
tethereal 0.10.13
Compiled with GLib 2.4.7, with libpcap 0.8.3, with libz
1.2.1.2,
without libpcre, with Net-SNMP 5.1.2, without ADNS.
NOTE: this build doesn't support the "matches" operator
for Ethereal filter syntax.
Running with libpcap version 0.8.3 on Linux
2.6.9-22.0.1.EL.
#
# tethereal -x -r css_ifspecific.cap | more (CentOS 4.2)
1 0.000000 172.21.118.70 -> 172.21.197.48 SNMP
RESPONSE IF-MIB::ifSpecific.1
0000 00 d0 59 37 2c a7 00 11 93 e5 74 46 08 00 45 00 ..Y7,.....tF..E.
0010 00 4a d6 bc 00 00 3f 11 11 45 ac 15 76 46 ac 15 .J....?..E..vF..
0020 c5 30 00 a1 04 02 00 36 43 fb 30 2c 02 01 01 04 .0.....6C.0,....
0030 07 68 61 74 74 6f 72 69 a2 1e 02 04 21 1c 26 e5 .hattori....!.&.
0040 02 01 00 02 01 00 30 10 30 0e 06 0a 2b 06 01 02 ......0.0...+...
0050 01 02 02 01 16 01 06 00 .......
Thank you!
Best Regards,
Hattori, Shigehiro / Sumisho Computer Systems Corp.