[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 12592
  • Last Modified:

Malformed TDS response packet on SQL Server Packets

Capturing network frames behind a SQL server 2005 NIC i get 70% of them being:

TDS      Response Packet[Malformed Packet]

It seems to affect Network requesting from that SQL server.

Anyone got a clue on what's going on ?

TCP is clear, only the TDS encapsuled in seems malformed.

Regards,

ws-capture.txt
0
elbosito
Asked:
elbosito
  • 4
  • 2
5 Solutions
 
Bill BachPresidentCommented:
Are you actually getting errors or having other issues?  It could be as simple that you are using a version of the TDS protocol that your network analyzer is unable to decode.  I assume that you used Wireshark?  Are you using the current version from www.wireshork.org?
0
 
elbositoAuthor Commented:
I used the latest version. is there a decode somewhere i can get?
ws-version.pdf
0
 
Bill BachPresidentCommented:
For decode, start here:
    http://www.freetds.org/tds.html
Note that the Docs go only through SQLServer 2005, and may have been interpretted after the fact.  The only definitive answer is the Microsoft Source code that creates the packets.  Obviously, if the decoder in WireShark is wrong, you'll need to perform a manual decode of the packet and see if it really is mangled.

I also found this in my searches:
    http://www.microsoft.com/technet/security/bulletin/ms99-059.mspx
It's old, but might be applicable.
0
Take Control of Web Hosting For Your Clients

As a web developer or IT admin, successfully managing multiple client accounts can be challenging. In this webinar we will look at the tools provided by Media Temple and Plesk to make managing your clients’ hosting easier.

 
PeterMiskaCommented:
I've been tracking down SQL Server Crashes for the past week.  They occured every 12 hours.  MS suggested tracing traffic to and from the server.  Wireshark reported malformed RPC packets for the TDS protocol.  What a dead end that turned out to be.

After reading  BillBachs post I checked the Wirehark bugs list, and sure enough TDS isn't parsed correctly for SQL Server 2005.  The bug wasn't addressed in version 1.0.

When we turned off replication the problems, SQL Server crashes stopped.

Anyone have a clue whay?  Yes, I'm being lazy.
0
 
Bill BachPresidentCommented:
Sounds like a problem with replication.  ;-)

As a question of SQLServer replication crashing will likely field an entirely different set of experts, you may wish to post this as a separate thread.
0
 
elbositoAuthor Commented:
does the problem PeterMiska has affect my Problems?
0
 
Bill BachPresidentCommented:
Sorry -- didn't look at the poster name.  Are you running replication, too?  

If Wireshark doesn't decode TDS correctly, then perhaps one of the other analyzers will, such as Observer or Wildpackets EtherPeek.
0

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now