Ethereal-dev: [ethereal-dev] Incorrect display filter behavior

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Laurent Deniel <deniel@xxxxxxxxxxx>
Date: Sun, 10 Oct 1999 14:49:01 +0200
 The attached pcap file shows a problem with display filters:

 - open it with no display filter
 - select a FTP data packet (e.g.  packet #52)
 - click on "-- File Transfer Protocol Data" (in tree window)
   (this selects from 52 to 1448 bytes)
 - now apply the "match selected" display filter
 - you can see now 4 packets in the packet list
   (packet #53 is the TCP ACK which of course does not contain the
   selected bytes but the cf->pd buffer still contains the bytes of 
   the previous packet ...)

 So it seems that comparison of fields does not take into account the
 captured packet length ...

 Laurent.

--
Laurent DENIEL        | E-mail: deniel@xxxxxxxxxxx
Paris, FRANCE         |         laurent.deniel@xxxxxxxxxxxxxxxxxxxxxxxxxxxx
                      | WWW   : http://www.worldnet.fr/~deniel
    All above opinions are personal, unless stated otherwise.

Attachment: filterbug.cap
Description: Binary data