FreeTDS Development Group

[Brian Bruns <brian AT bruns.com>]

Hi Steve,

I wrote the original decoder for Wireshark (then Ethereal), but my knowledge
of it's current state is a little dated.  One possibility is that the
decoder is a little behind the times and doesn't understand some aspect of
the protocol as used by SQL Server and will throw up its hands with the
"Malformed Packet".

Beyond that, if the malformed packet is coming from SQL Server (as opposed
to a client -> server packet coming from FreeTDS, jTDS, or MS client) which
a source port of 1433 would indicate, I would highly suspect the decoder in
Wireshark to be faulty.  MS defines the protocol (for versions 7.0+ at
least) and therefore barring any software malfunction, it would not be
crafting malformed packets.

Are you seeing any other symptoms of problems, or did this just show up with
the network trace?  If so I'd place my bets on this being a red herring.

Brian

(Sorry if everyone gets this twice, the first time I sent it didn't seem to
go through)


2009/7/30 Steve Fischer <SFischer AT merkleinc.com>

> I am a network engineer investigating a complaint of slow application
> performance.  In doing a capture (using Wireshark), I noticed a fair
> number (about 125 in a 10 minute window) of responses coming from a host
> on 1433/TCP (Response Packet) with a Malformed Packet:TDS label on the
> payload.  I know that 1433/TCP is the port Microsoft SQL Server uses,
> and until today, had never heard of TDS as a protocol.  Can anyone here
> shed some light on this?  The research I've done regarding "Malformed
> Packet" and Wireshark indicates that something in the response the
> server is crafting is amiss, but as to what, I'd have not even the
> slightest clue.  I'd be happy to forward the capture file to anyone who
> could help me get to the bottom of this mystery.  Whatever this is, it
> can't be helping performance any I'd assume.  Thanks in advance for any
> assistance that anyone can provide.
>
> Steve Fischer
> Sr. Network Engineer.
>
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
>