In WireShark 1.4.2 I'm trying to create pcap dumps of GIOP data so I can peer into the giop details more easily. I'm starting with a hex dump, converted to pcap with: text2pcap -o dec -T 50,60 c:out.txt c:out.pcap (out.txt is at the end of this message for reference) And opening the resulting pcap file in WireShark everything down to the TCP frame looks OK except that the payload isn't displayed, not even as raw data. Am I missing something? Thanks, 000000 47 49 4f 50 01 02 00 00 00 00 ca fe 00 00 0d 60 asked 19 Nov '10, 15:00 eboregelna |
One Answer:
I have an answer to my question: The GIOP packets being reported as data sent from webLogic's corba debugging are having their 'message size' field stomped on before being logged. Therefore the GIOP dissector wants to see more data before it reports the packet. I avoided the issue for now as I don't really need the sent packets, just the received. If I did need them I'd have my script to extract the data from the logs reconstruct the length from context in the log file. -Rob answered 23 Nov '10, 13:08 eboregelna |