NLM decoding in NetMon and Sniffer is known to be suboptimal. For NLM, goto Edit/Preferences/Protocols/NLM and enable ethereal to keep track of request/response matching for async NLM and see what we do normally and none else can do.
Maybe they have hardcoded the offset of where NLM starts into the packet and get confused by some header being too unexpectedly long. ----- Original Message ----- From: "Dr. Uwe Girlich" Sent: Wednesday, January 22, 2003 6:23 PM Subject: [Ethereal-dev] NLM decode problem Ethereal vs. Sniffer Pro > Hello! > > I just got my hands on a NLMv4 trace file (NFS3 lock manager). > > Interesting is packet 10 (NLMv4 UNLOCK reply, XID 574db2a6): > Ethereal decodes NLM beginning at offset 0x52 and Sniffer Pro 4.50.04 is > reported to decode NLM data beginning at offset 0x4e, which is totally > incorrect. Can anyone with this Sniffer version try it out? > > But anyway, here we have another NLM test pattern file. > > Bye, Uwe > >
