Ethereal-users: Re: [Ethereal-users] malformed packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 22 Aug 2006 10:33:03 -0700
-------------------
The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxx.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------

brent wrote:

No.     Time        Source                Destination           Protocol
Info                                                            SRC    DEST
      1 0.000000    10.1.1.247            10.1.198.111          UDP
Source port: 5100  Destination port: 5000[Malformed Packet]     5100   5000

Frame 1 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Intel_a7:4e:3f (00:0e:0c:a7:4e:3f), Dst: Cisco_5e:97:00
(00:0a:f4:5e:97:00)
Internet Protocol, Src: 10.1.1.247 (10.1.1.247), Dst: 10.1.198.111
(10.1.198.111)
User Datagram Protocol, Src Port: 5100 (5100), Dst Port: 5000 (5000)
Cross Point Frame Injector [Malformed Packet: CPFI]

Unless you have, on your network, a piece of equipment from Compunter Network Technology (CNT) or McData (CNT was bought by McData in 2005) that transports Fibre Channel data over UDP, the problem is almost certainly that the dissector for CNT's Cross Point Frame Injector protocol is being called for packets that *aren't* CPFI packets.

That's an inherent problem with dissecting protocols running over TCP or UDP - there's no guarantee that a given port is being used by a given protocol. You could try disabling the CPFI dissector by going to Analyze -> Enabled Protocols and un-checking the entry for Cross Point Frame Injector.
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users