FreeTDS Development Group

[Brian Bruns <brian AT bruns.com>]

Hi Steve,

If you read the comments at the top of

http://anonsvn.wireshark.org/viewvc/releases/wireshark-1.2.1/epan/dissectors/packet-tds.c?revision=29148&content-type=text%2Fplain

Key to understanding what is going on is the first byte in the TDS portion
of each packet.  It could be that there is an open connection and the
webserver (or script thereon) is doing queries, or it could be that it is
attempting to login (unsuccessfully possibly).  The packet type will tell
much about what is going on.

Brian

2009/7/30 Steve Fischer <SFischer AT merkleinc.com>

> Brian, and all who have responded...thanks.
> What I am seeing is groups of three packets
> 1. client (in this case, the web server) sends RPC packet to dest port
> 1433
> 2. server sends response sourced from 1433/TCP
> 3. Client sends back an ACK to dest 1433/TCP
>
> This whole "three way handshake" (I know that's not what it is, but it
> does resemble that) takes on average less than .2 sec to complete, and
> is occurring on regular 5 second intervals.  The five second interval is
> pretty constant - this happened EVERY 5 seconds for the duration of the
> capture.  It looks like some attempt could be being retried, but again,
> not having a level of expertise in database, or in this level of packet
> analysis, I'm flying blind. But, if it were something the client or
> server was retrying, it would have to be far higher in the stack than
> layer-3.
>
> -----Original Message-----
> From: freetds-bounces AT lists.ibiblio.org
> [mailto:freetds-bounces AT lists.ibiblio.org] On Behalf Of Brian Bruns
> Sent: Thursday, July 30, 2009 1:31 PM
> To: FreeTDS Development Group
> Subject: Re: [freetds] Malformed Packets
>
> Hi Steve,
>
> I wrote the original decoder for Wireshark (then Ethereal), but my
> knowledge of it's current state is a little dated.  One possibility is
> that the decoder is a little behind the times and doesn't understand
> some aspect of the protocol as used by SQL Server and will throw up its
> hands with the "Malformed Packet".
>
> Beyond that, if the malformed packet is coming from SQL Server (as
> opposed to a client -> server packet coming from FreeTDS, jTDS, or MS
> client) which a source port of 1433 would indicate, I would highly
> suspect the decoder in Wireshark to be faulty.  MS defines the protocol
> (for versions 7.0+ at
> least) and therefore barring any software malfunction, it would not be
> crafting malformed packets.
>
> Are you seeing any other symptoms of problems, or did this just show up
> with the network trace?  If so I'd place my bets on this being a red
> herring.
>
> Brian
>
> (Sorry if everyone gets this twice, the first time I sent it didn't seem
> to go through)
>
>
> 2009/7/30 Steve Fischer <SFischer AT merkleinc.com>
>
> > I am a network engineer investigating a complaint of slow application
> > performance.  In doing a capture (using Wireshark), I noticed a fair
> > number (about 125 in a 10 minute window) of responses coming from a
> > host on 1433/TCP (Response Packet) with a Malformed Packet:TDS label
> > on the payload.  I know that 1433/TCP is the port Microsoft SQL Server
>
> > uses, and until today, had never heard of TDS as a protocol.  Can
> > anyone here shed some light on this?  The research I've done regarding
>
> > "Malformed Packet" and Wireshark indicates that something in the
> > response the server is crafting is amiss, but as to what, I'd have not
>
> > even the slightest clue.  I'd be happy to forward the capture file to
> > anyone who could help me get to the bottom of this mystery.  Whatever
> > this is, it can't be helping performance any I'd assume.  Thanks in
> > advance for any assistance that anyone can provide.
> >
> > Steve Fischer
> > Sr. Network Engineer.
> >
> > _______________________________________________
> > FreeTDS mailing list
> > FreeTDS AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/freetds
> >
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
>