Wireshark-bugs: [Wireshark-bugs] [Bug 10363] HTTP responses don't show up with reassembly enable
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 12 Aug 2014 17:57:43 +0000

changed bug 10363


What Removed Added
Status UNCONFIRMED CONFIRMED
Component GTK+ UI Dissection engine (libwireshark)
Hardware x86-64 All
Summary HTTP responses HTTP responses don't show up with reassembly enabled
Ever confirmed   1
OS Ubuntu All

Comment # 2 on bug 10363 from 
I'm seeing the same thing with a somewhat recent trunk build.

If I turn off reassembly, I see a response beginning in frame 14, with a
Content-Length of 34145 bytes.  If I filter on that frame's IP source and
destination addresses and TCP source and destination port, I see the packets
from the server to the client in that connection.

Frame 14's TCP sequence number is 1656 and its length is 309, so the next
sequence number would be 1965.

Frame 17 has a sequence number of 1965 but is just an ACK with no payload.

Frame 18 also has a sequence number of 1965 but is *another* HTTP response
rather than a continuation of the response beginning in frame 14!

The server seems to be sending out bogus HTTP.

You are receiving this mail because:
  • You are watching all bug changes.