Hi Sean, Don't worry: the capture you sent is correctly decoded, however it is speckled with TCP streams containing invalid HTTP with request "GET /", and response starting with "<title>404 Not Found</title>".
If you filter out those with the filter string: "!(ip.addr == 192.168.100.11)", then you get the correct MMSE packets. Regards, Olivier ----- Original Message ----- From: "Sean Schneyer (TX/EUS)" | Hi, | | Sorry for forgetting the attachment. | | I tried setting the preferences as you suggested and that didn't change the behavior. | | So, here is the attachment this time. | | // Sean | | | | -----Original Message----- | From: Olivier Biot | | Hi Sean, | | Your message did not contain the attached capture, but maybe I can | explain some things :) | | The last 2 months there has also been a major update to the HTTP | dissector. If you go to the Protocol options in the Preferences, and | select the HTTP protocol, you'll see 2 new preferences. One preference | reassembles the HTTP headers, while the 2nd preference attempts at | reassembling the HTTP entity body based on the Content-Length header | value. Try switching on both preferences, and you should see the MMSE | content being dissected again. | | If this is not the case, maybe you could send us a capture you can | disclose so we can look at the root cause, which may be that the | entity body is longer than the reported content length, resulting in | the body never being reassembled (and hence never being dissected as | MMSE). | | Regards, | | Olivier | ----- Original Message ----- | From: Sean Schneyer (TX/EUS) | | Hi, | I recently tried to upgrade from 0.9.7 to 0.10.0 and found that the | MMSE protocol support is not working as expected. I then started | working my way backwards and found that it works as expected in | 0.9.16. Attached is a trace that demonstrates what I am talking about. | In 0.9.16 packet 149 is properly identified as a MMS m-send-req, but | in 0.10.0 it is simply identified as an HTTP Continuation. | When I did a diff between the packet-mmse.c from the two versions, | there were some changes made to the code. Unfortunately, I'm not | familiar enough with the ethereal codebase to know if they are | significant or not: | | | _______________________________________________ Ethereal-dev mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-dev
