Hi, Wireshark marked one of my packets as malformed and I am struggling to find the reason. The packet in hex format is:
This is a TCP packet with one byte data. The data byte is the second last byte in the penultimate line ('02'). The problem is, if I change the data to anything else (say, make the data byte '01'), the Wireshark considers the packet legitimate. I.e, Wireshark considers the following packet good.
Will appreciate any help. Thank you. asked 09 Jun '15, 11:36 dineshpandey |
One Answer:
Your first frame gets erroneously dissected by the FTMP dissector (Flight Message Transfer Protocol). If you disable that dissector, the frame is not marked as malformed anymore.
Regards answered 10 Jun '15, 04:06 Kurt Knochner ♦ |
Just wanted to add.
uname -a: Linux venus.localdomain 2.6.32-504.1.3.el6.x86_64 #1 SMP Tue Nov 11 17:57:25 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
Wireshark version: 1.8.10