Fragmented packets
"Tate, Denis - UK" <[email protected]> Mon, 2 Oct 2006 10:45:03 +0100
| Newsgroups | gmane.network.ethereal.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============1452491222== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------- The Ethereal project is being continued at a new site. Please go to http://www.wireshark.org and subscribe to [email protected]. Don't forget to unsubscribe from this list at http://www.ethereal.com/mailman/listinfo/ethereal-users ------------------- --===============1452491222== content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6E607.6F92085E" This is a multi-part message in MIME format. ------_=_NextPart_001_01C6E607.6F92085E Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi - Can you help me I'm using ethereal 0.10.14 to decode some SNMP messages for our application. I've set up the mib's so that ethereals' SNMP protocol decoder can display the messages correctly in ethereals own captures and is able to cope with fragmented packets by re-combining them. A 3rd party has captured some traffic using an unknown analyser and presented me with the trace in a '.dat' file The only problem is that some of the packets, due to the size of the message are fragmented, which the SNMP decoder cannot process. Is there any way of setting ethereal to re-combine the fragmented packets, or the SNMP decoder to process the fragmented packets, or does this have to be done 'at source' ? best regards, Denis Tate Senior Systems Engineer > Peek Traffic Limited. General: +44 (0) 1923 289310 Direct: +44 (0) 1923 289328 Fax: +44 (0) 1923 859195 Web:www.peek-traffic.co.uk The information in this e-mail is confidential and is intended for the addressee only. Access to this e-mail by anyone else has not been authorised by Peek Traffic Ltd. It is not to be relied upon by any person other than the addressee except with our prior written approval. If no such approval is given, we will not accept any liability (in negligence or otherwise) arising from any third party acting, or refraining from acting, on such information. Unauthorised recipients are requested to maintain confidentiality. If you have received this e-mail in error, please notify us immediately by e-mailing [email protected] or calling 01923 289310 or faxing 01923 859195, and also we would ask you to destroy any copies and delete this e-mail from your computer system. Copyright in this e-mail and any document created by us will be and remain vested in us and will not be transferred to you. ------_=_NextPart_001_01C6E607.6F92085E Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 6.0.6487.1"> <TITLE>Fragmented packets</TITLE> </HEAD> <BODY> <!-- Converted from text/rtf format --> <P><FONT SIZE=3D2 FACE=3D"Arial">Hi - Can you help me</FONT> <BR> <FONT SIZE=3D2 = FACE=3D"Arial">I'm using ethereal 0.10.14 to decode some SNMP messages = for our application.</FONT> <BR> <FONT SIZE=3D2 = FACE=3D"Arial">I've set up the mib's so that ethereals' SNMP protocol = decoder can display the messages correctly in ethereals own captures and = is able to cope with fragmented packets by re-combining them.</FONT></P> <P> <FONT SIZE=3D2 = FACE=3D"Arial">A 3rd party has captured some traffic using an unknown = analyser and presented me with the trace in a '.dat' file</FONT></P> <P> <FONT SIZE=3D2 = FACE=3D"Arial">The only problem is that some of the packets, due to the = size of the message are fragmented, which the SNMP decoder cannot = process.</FONT></P> <P> <FONT SIZE=3D2 = FACE=3D"Arial">Is there any way of setting ethereal to re-combine the = fragmented packets, or the SNMP decoder to process the fragmented = packets, or does this have to be done 'at source' ?</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Arial">best regards,</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">Denis Tate</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">Senior Systems Engineer</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">Peek Traffic Limited.</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">General: +44 (0) 1923 = 289310</FONT> <BR><SPAN LANG=3D"en-gb"><FONT SIZE=3D2 = FACE=3D"Arial">Direct: +44 (0) 1923 = 289328</FONT></SPAN> <BR><SPAN LANG=3D"en-gb"><FONT SIZE=3D2 = FACE=3D"Arial">Fax: +44 (0) = 1923 859195</FONT></SPAN> <BR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Arial">Web:www.peek-traffic.co.uk</FONT></SPAN> <P ALIGN=3DCENTER><SPAN LANG=3D"en-gb"><FONT SIZE=3D2 FACE=3D"Arial">The = information in this e-mail is confidential and is intended for the = addressee only. Access to this e-mail by anyone else has not been = authorised by Peek Traffic Ltd.</FONT></SPAN></P> <P ALIGN=3DCENTER><SPAN LANG=3D"en-gb"><FONT SIZE=3D2 FACE=3D"Arial">It = is not to be relied upon by any person other than the addressee except = with our prior written approval. If no such approval is given, we will = not accept any liability (in negligence or otherwise) arising from any = third party acting, or refraining from acting, on such information. = Unauthorised recipients are requested to maintain confidentiality. If = you have received this e-mail in error, please notify us immediately by = e-mailing </FONT><FONT COLOR=3D"#0000FF" SIZE=3D2 = FACE=3D"Arial">[email protected]</FONT><FONT SIZE=3D2 = FACE=3D"Arial"> or calling </FONT><FONT COLOR=3D"#0000FF" SIZE=3D2 = FACE=3D"Arial">01923 289310</FONT><FONT SIZE=3D2 FACE=3D"Arial"> or = faxing </FONT><FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial">01923 = 859195</FONT><FONT SIZE=3D2 FACE=3D"Arial">, and also we would ask you = to destroy any copies and delete this e-mail from your computer system. = Copyright in this e-mail and any document created by us will be and = remain vested in us and will not be transferred to = you.</FONT></SPAN></P> <BR> </BODY> </HTML> ------_=_NextPart_001_01C6E607.6F92085E-- --===============1452491222== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ethereal-users mailing list [email protected] http://www.ethereal.com/mailman/listinfo/ethereal-users --===============1452491222==--