This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm running a packet capture on a x64 Windows Server 2008 R2 system running the latest version of x64 wireshark (1.6.7). Everytime I see the following packet, all traffic that is to follow is [Malformed Packet].

This particular packet is categorized as SMB2 and is connecting to this server on port 445. There are only two things that jump out at me as they are different from the other captured packets.

Info Level: SMB2_FIND_ID_BOTH_DIRECTORY_INFO
Search Pattern: *

When I restart wireshark, all is back to normal and I see traffic as expected. Until this particular packet hits.

Is this a symptom of a parser error?

asked 16 Apr '12, 13:40

pjhan's gravatar image

pjhan
1111
accept rate: 0%


It's possible that there is a bug in the SMB2 dissector. We'd probably have to see a sample capture to determine whether that's the case and, if it is, to determine what the bug is and to fix it.

File a bug about this on the Wireshark Bugzilla, and attach a capture to the bug.

permanent link

answered 16 Apr '12, 17:01

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×248
×52
×47

question asked: 16 Apr '12, 13:40

question was seen: 3,850 times

last updated: 16 Apr '12, 17:01

p​o​w​e​r​e​d by O​S​Q​A