[Red5] Bad network data...

[alexandre houdent]

Thanks Mick,

I don't think I'll be able to reproduce this one... And sniffing all the
traffic all the time won't be possible...

A test that might be interstting... Sending this (or one described by the
posts on the web, http://tinyurl.com/9x5qy ) weird AMF packet to FCS again
to see if it crashes...

Doesn't it seems like somebody trying to "talk" directly to FCS but sends an
altered packet or somtehing that makes FCS crash... (bad!).

To be continued (...) ;-)

On 10/11/05 21:39, "Herres, Mick" <mherres at UII.com> wrote:

> Hi Alexandre,
> 
> I have reformatted your byte output as best I could.  It looks like some
> of it was converted to ASCII and some was not, which is strange.
> 
> 00 88 02 29 00 BE 19 D7     00 44 00 15 00 9A 00 63
> 00 40 00 41 00 B6 00 2F     00 7C 52 AD 02 12 06 3B
> 00 F8 02 59 00 AE 02 87     00 B4 00 45 00 8A 01 13
> 00 B0 01 71 00 A6 F0 DF     52 EC 01 DD 00 02 00 EB
> 00 68 F9 89 05 9E 00 37     00 24 4E 75 03 7A 00 C3
> 00 55 A1 00 96 53 8F 02     5C 00 0D 02 F2 F9 9B 00
> D8 4E B9 03 8E 01 E7 00     94 00 A5 00 6A 00 73 00
> 90 00 D1 02 86 18 3F 77     CC 9D 3D 65 E2 00 4B 02
> 48 00 E9 00 7E 00 97 00     04 10 D5 74 5A 14 23 74
> 00 02 01 00 76 00 EF 00     3C F0 6D 00 D2 4E FB 03
> B8 00 19 00 6E F9 47 05     74 FB 05 05 4A FC D3 05
> 50 00 31 00 66 00 9F 12     AC 01 9D 00 C2 AB 7F 28
> 02 49 00 5E 02 F7 00 E4     00 35 00 3A 00 83 00 E0
> 00 61 00 56 00 4F 00 1C     06 CD 00 B2 02 5B 00 98
> 02 79 00 4E 17 A7 77 54     18 65 77 2A 00 33 00 50
> 00 91 00 46 00 FF 00 8C     00 FD 00 A2 00 0B 00 08
> 12 A9 02 3E FD 57 05 C4     6E 95 00 1A 6D E3 00 C0
> FC C1 05 36 6D AF 00 FC     FE 2D 05 92 22 BB 02 78
> E7 D9 77 2E 57 07 02 34     04 C5 00 0A 06
> 
> I'm not convinced this is exactly what the actual byte stream was as I
> am not seeing the correct sectioning of the AMF data.  If you get a
> chance, try to use a packet sniffing program (preferably Ethereal) and
> post that file.  I might have a better chance of understanding what is
> going on if I can see the context of these bytes.
> 
> mick
> 
> -----Original Message-----
> From: Red5-bounces at osflash.org [mailto:Red5-bounces at osflash.org] On
> Behalf Of alexandre houdent
> Sent: Thursday, November 10, 2005 12:11 PM
> To: Red5 at osflash.org
> Subject: [Red5] Bad network data...
> 
> Hello,
> 
> Might seem strange to post a FCS question here but I have searched the
> web
> and sent previous messages to FCS lists whithout success. Plus it seems
> to
> be more a "rtmp" matter rather than a FCS one ;-)
> 
> FCS stops for a mysterious reason and the trace is:
> 
> flashcom Adaptor[30271]: Bad network data;
> terminating connection : (Adaptor: _defaultRoot_, VHost:
> _defaultVHost_, IP: xxx.xxx.xxx.xxx, App: Unknown, Protocol: rtmp,
> Exception: N/A)  00 88 02 ) 00 BE 19 D7 00 D 00 15 00 9A 00 c 00 @
> 00 A 00 B6 00 / 00 | R AD 02 12 06 ; 00 F8 02 Y 00 AE 02 87 00 B4
> 00 E 00 8A 01 13 00 B0 01 q 00 A6 F0 DF R EC 01 DD 00 02 00 EB 00
> h F9 89 05 9E 00 7 00 $ N u 03 z 00 C3 00   U A1 00 96 S 8F 02 \
> 00 0D 02 F2 F9 9B 00 D8 N B9 03 8E 01 E7 00 94 00 A5 00 j 00 s 00
> 90 00 D1 02 86 18 ? w CC 9D = e E2 00 K 02 H 00 E9 00 ~ 00 97 00
> 04 10 D5 t Z 14 # t 00 02 01 00 v 00 EF 00 < F0 m 00 D2 N FB 03 B8
> 00 19 00 n F9 G 05 t FB 05 05 J FC D3 05 p 00 1 00 f 00 9F 12 AC
> 01 9D 00 C2   AB 7F ( 02 I 00 ^ 02 F7 00 E4 00 5 00 : 00 83 00 E0
> 00 a 00 V 00 O 00 1C 06 CD 00 B2 02 [ 00 98 02 y 00 N 17 A7 w T 18
> e w * 00 3 00 P 00 91 00 F 00 FF 00 8C 00 FD 00 A2 00 0B 00 08 12
> A9 02 > FD W 05 C4 n 95 00 1A m E3 00 C0 FC C1 05 6 m AF 00 FC FE
> - 05 92 " BB 02 x E7 D9 w . W 07 02 4 04 C5 00 0A 06
> 
> (IP was not xxx.xxx.xxx.xxx but a real IP)
> 
> It seems like a recurrent issue cf http://tinyurl.com/9x5qy mostly on
> linux...
> 
> Nobody seems to have found an explanation/workaround yet...
> 
> Thanks ;-)

-- 
Cordialement / Regards,

Alexandre Houdent
http://www.GlobZ.com/
80, quai de jemmapes
75010 Paris, France
t/ 331 533 888 55
f/ 331 533 888 57