This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Malformed smrse packet

0

Hi everyone,

Getting "malformed smrse packet (exception occured)" errors on our Win2003 server. Anything I should be concerned about?

asked 05 Sep '12, 15:02

quickpath's gravatar image

quickpath
1111
accept rate: 0%


One Answer:

0

Please refer to the malformed wiki page.

answered 05 Sep '12, 18:51

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

In particular, note the list on that page:

There are three main causes:

  • protocol data is malformed
  • protocol dissector is buggy
  • wrong protocol dissector used

Very often, the third of those is the real reason; for TCP and UDP traffic, Wireshark often has to guess the next protocol for packets based either on a port number or on the packet contents, and can guess wrong. For SMRSE, it's based on the port number; if non-SMRSE traffic goes to or from port 4321, it may be mis-dissected as SMRSE. Try disabling the SMRSE dissector.

(07 Sep '12, 14:42) Guy Harris ♦♦