Ask Your Question
0

"Trailing stray characters" warning

asked 2019-02-27 10:28:24 +0000

updated 2019-02-27 10:36:44 +0000

Hi all,

Could you please tell what is the meaning of "Trailing stray characters" WS Expert system warning?

image description

The packet is a part of TCP stream containing clear text request-response type of conversation (SQL-type protocol).

There's no issue, I'm just curious about what could have caused this warning.

Wireshark Version 3.1.0rc0-163-g7a482205, Windows 10 x64

edit retag flag offensive close merge delete

4 Answers

Sort by » oldest newest most voted
2

answered 2019-03-01 14:06:42 +0000

Stig gravatar image

You have configured Show data as text in the Data dissector. The data you are showing as text is zero terminated inside the string so you will not see all the data as text. The warning is trying to tell you this, you have trailing characters which is not shown.

The warning is useful when found in a protocol having data which is text strings. It's not that useful in this case where you are "forcing" whatever data is found to be shown as text.

Maybe the text should be updated to be more clear what happened.

edit flag offensive delete link more

Comments

Thank you for explanation! Indeed, the error is gone after I disabled Show data as text setting.

Packet_vlad gravatar imagePacket_vlad ( 2019-03-01 14:17:19 +0000 )edit
1

answered 2019-02-27 15:49:40 +0000

Jaap gravatar image

This has come in with this change. It warns about text which is contained in the protocol item, but does not normally appear on a display due to NULL character(s) in the string.

edit flag offensive delete link more

Comments

cmaynard gravatar imagecmaynard ( 2019-02-27 17:34:00 +0000 )edit
1

answered 2019-02-27 19:18:23 +0000

Guy Harris gravatar image

That data does not, in fact, appear to be text; either:

  1. the protocol is not, in fact, a clear-text protocol;
  2. it is a clear-text protocol, but it's encrypted, and the encrypted text is being displayed as if it were plaintext;
  3. not all of the protocol is in clear text, but you're displaying the non-clear-text part as clear text;
  4. the packet is being dissected by the dissector for that protocol, but it is, in fact, not traffic for that protocol;

etc..

edit flag offensive delete link more

Comments

Thank you all for the answers! Indeed the protocol contains clear-text parts (usually requests) followed by mixed clear- and non-clear-text (responses). Unfortunately I can't demonstrate it because of confidential content. But know I understand the idea.

Packet_vlad gravatar imagePacket_vlad ( 2019-02-27 19:37:13 +0000 )edit

So perhaps the "Trailing stray characters" warning should be "Trailing stray characters or non-text displayed as text", or something such as that.

Guy Harris gravatar imageGuy Harris ( 2019-02-27 19:42:52 +0000 )edit
1

answered 2019-02-27 15:37:05 +0000

cmaynard gravatar image

This appears to be the result of the following 2 commits:

The implementation would appear to be flawed and a Wireshark bug report would seem to be in order here.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-02-27 10:28:24 +0000

Seen: 91 times

Last updated: Mar 01