FreeTDS Development Group

["Steve Fischer" <SFischer AT merkleinc.com>]

Brian, and all who have responded...thanks.
What I am seeing is groups of three packets
1. client (in this case, the web server) sends RPC packet to dest port
1433 
2. server sends response sourced from 1433/TCP
3. Client sends back an ACK to dest 1433/TCP

This whole "three way handshake" (I know that's not what it is, but it
does resemble that) takes on average less than .2 sec to complete, and
is occurring on regular 5 second intervals.  The five second interval is
pretty constant - this happened EVERY 5 seconds for the duration of the
capture.  It looks like some attempt could be being retried, but again,
not having a level of expertise in database, or in this level of packet
analysis, I'm flying blind. But, if it were something the client or
server was retrying, it would have to be far higher in the stack than
layer-3.

-----Original Message-----
From: freetds-bounces AT lists.ibiblio.org
[mailto:freetds-bounces AT lists.ibiblio.org] On Behalf Of Brian Bruns
Sent: Thursday, July 30, 2009 1:31 PM
To: FreeTDS Development Group
Subject: Re: [freetds] Malformed Packets

Hi Steve,

I wrote the original decoder for Wireshark (then Ethereal), but my
knowledge of it's current state is a little dated.  One possibility is
that the decoder is a little behind the times and doesn't understand
some aspect of the protocol as used by SQL Server and will throw up its
hands with the "Malformed Packet".

Beyond that, if the malformed packet is coming from SQL Server (as
opposed to a client -> server packet coming from FreeTDS, jTDS, or MS
client) which a source port of 1433 would indicate, I would highly
suspect the decoder in Wireshark to be faulty.  MS defines the protocol
(for versions 7.0+ at
least) and therefore barring any software malfunction, it would not be
crafting malformed packets.

Are you seeing any other symptoms of problems, or did this just show up
with the network trace?  If so I'd place my bets on this being a red
herring.

Brian

(Sorry if everyone gets this twice, the first time I sent it didn't seem
to go through)


2009/7/30 Steve Fischer <SFischer AT merkleinc.com>

> I am a network engineer investigating a complaint of slow application 
> performance.  In doing a capture (using Wireshark), I noticed a fair 
> number (about 125 in a 10 minute window) of responses coming from a 
> host on 1433/TCP (Response Packet) with a Malformed Packet:TDS label 
> on the payload.  I know that 1433/TCP is the port Microsoft SQL Server

> uses, and until today, had never heard of TDS as a protocol.  Can 
> anyone here shed some light on this?  The research I've done regarding

> "Malformed Packet" and Wireshark indicates that something in the 
> response the server is crafting is amiss, but as to what, I'd have not

> even the slightest clue.  I'd be happy to forward the capture file to 
> anyone who could help me get to the bottom of this mystery.  Whatever 
> this is, it can't be helping performance any I'd assume.  Thanks in 
> advance for any assistance that anyone can provide.
>
> Steve Fischer
> Sr. Network Engineer.
>
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
>
_______________________________________________
FreeTDS mailing list
FreeTDS AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/freetds