"Trailing stray characters" warning

asked Feb 27 '19

Packet_vlad

1055 ●5 ●75 ●32 http://packettrain.net

updated Feb 27 '19

Hi all,

Could you please tell what is the meaning of "Trailing stray characters" WS Expert system warning?

image description

The packet is a part of TCP stream containing clear text request-response type of conversation (SQL-type protocol).

There's no issue, I'm just curious about what could have caused this warning.

Wireshark Version 3.1.0rc0-163-g7a482205, Windows 10 x64

add a comment

4 Answers

Sort by » oldest newest most voted

answered Mar 1 '19

Stig

138 ●7 ●6

You have configured Show data as text in the Data dissector. The data you are showing as text is zero terminated inside the string so you will not see all the data as text. The warning is trying to tell you this, you have trailing characters which is not shown.

The warning is useful when found in a protocol having data which is text strings. It's not that useful in this case where you are "forcing" whatever data is found to be shown as text.

Maybe the text should be updated to be more clear what happened.

link

Comments

Thank you for explanation! Indeed, the error is gone after I disabled Show data as text setting.

Packet_vlad ( Mar 1 '19 )

add a comment

answered Feb 27 '19

Jaap

13782 ●716 ●115

This has come in with this change. It warns about text which is contained in the protocol item, but does not normally appear on a display due to NULL character(s) in the string.

link

Comments

… and this related change.

cmaynard ( Feb 27 '19 )

add a comment

answered Feb 27 '19

Guy Harris
19905 ●3 ●670 ●207

That data does not, in fact, appear to be text; either:

the protocol is not, in fact, a clear-text protocol;
it is a clear-text protocol, but it's encrypted, and the encrypted text is being displayed as if it were plaintext;
not all of the protocol is in clear text, but you're displaying the non-clear-text part as clear text;
the packet is being dissected by the dissector for that protocol, but it is, in fact, not traffic for that protocol;

etc..

link

Comments

Thank you all for the answers! Indeed the protocol contains clear-text parts (usually requests) followed by mixed clear- and non-clear-text (responses). Unfortunately I can't demonstrate it because of confidential content. But know I understand the idea.

Packet_vlad ( Feb 27 '19 )

So perhaps the "Trailing stray characters" warning should be "Trailing stray characters or non-text displayed as text", or something such as that.