Wireshark-bugs: [Wireshark-bugs] [Bug 12855] Follow TCP Stream shows duplicate stream data
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 04 Oct 2016 14:45:17 +0000

Comment # 14 on bug 12855 from 
(In reply to Pascal Quantin from comment #13)
> (In reply to Michael Mann from comment #10)
> > With this, I have a harder time determining which is "better". master skips
> > "Third", but includes "Last".  2.0.5 skips/misses "Last".
> 
> Given that there is a definitely lost segment between the fifth and the last
> one, 2.0.x output is the valid one IMHO.

I can understand that.  Another problem that I noticed was that the Follow TCP
stream behavior of "skipping" the "Third" is also exhibited by Export PDU
(layer 4).  So the current implementation of just tapping tvbs (for Follow TCP
and Export PDU) isn't complete enough for the desired behavior.  However, I
would like to have such a solution in the TCP dissector so that it's all in one
place.

Some potential ideas (just thinking out loud)

1. Maybe some combination of the seq/ack analysis tied to the tvbs (ie
appending the existing seq/ack structures to somehow include tvb data)?  Don't
necessarily want all of that data in memory.
2. Have a "putting TCP stream together" "shim" that does the reassembly to pass
the results to Follow TCP stream and Export PDU.  Really trying to avoid
"reverting" to using a file.

You are receiving this mail because:
  • You are watching all bug changes.