What does yellow color means in Package Details?
Hi,
Wireshark 4.0.4 I see some yellow background color in Package Details. What does this yellow color means?
Thanks
add a comment
The first warning, for "External name", means "If I treat this as if it's ASCII, it's not valid ASCII", which is not surprising, given that it's not ASCII at all, it's EBCDIC (as indicated by the next item after it).
The second warning, for "Manager-Level List", also says it's not valid ASCII, but it doesn't look like valid EBCDIC either.
The second warning, for "Manager-Level List", also says it's not valid ASCII, but it doesn't look like valid EBCDIC either.
It doesn't appear to be, from a quick look at some DRDA specs. The Wireshark DRDA dissector is pretty primitive, so don't rely on it to give a detailed dissection of DRDA packets.
@Chuckc, thanks for pointing me out to documentation. @Guy Harris, thanks for the info about possible problems. I have looked into this packets in more detail and there are several ASCII vs. EBCDIC packets displayed and only few of them are displayed with background yellow color. It looks to me that yellow background color is not displayed when data is encoded in EBCDIC instead of ASCII, but yellow is displayed when Wireshark programmer was not sure about how to decode portion of network traffic (or this part of protocol was not analyzed yet to properly decode it or some info in the string is not so important to decode it or similar). Wireshark programmer just want to put out: "Warning, something is not decoded perfectly". In this case "Expert Info" is added with explanation like: "Expert Info (Warning/Undecoded): Trailing stray characters". In case of "Manager-Level List" only first 30 ...
@Guy Harris, yes I see now, DRDA protocol in Wireshark is not decoded perfectly. It has multiple limitations. I have read some articles and it is pointed out this same info (non perfect decoding), but was stated that other network analysis tools (beside Wireshark) take Wireshark's library to decode DRDA protocol. If this is true, then other tools are probably no better then Wireshark (maybe even worse, because they most probably use some older Wireshark DRDA library then Wireshark, because Wireshark is moving faster and providing new versions faster). Do you have any suggestion what other tool to use DRDA protocol or did you just write general statement that some other (you don't know which one) tool may be better to decode DRDA protocol? I have investigated Wireshark DRDA protocol little bit in more detail. What I see protocol section has three parts: length (exactly two bytes), code ...
