Ethereal-dev: Re: [Ethereal-dev] Bug: follow TCP stream eats 1st byte

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 7 Nov 2003 15:36:56 -0800

On Nov 7, 2003, at 3:21 PM, Biot Olivier wrote:
I have all but the last TCP protocol item enabled. I didn't have this issue 
in Ethereal 0.9.15. I'm running Ethereal on WinXP. On my build version
(recent CVS snapshot; GTK+-2), I only have the first 2 TCP options checked, 
and the problem does not occur.
"Relative sequence numbers and window scaling" appears to be the culprit - if I turn it on, the "G" disappears from the HTTP stream I have, and if I turn it off, the "G" appears again. 

If I have it disabled:

	the initial SYN has sequence number 358236700;

	the SYN+ACK of the initial SYN has sequence number 221046327;

	the ACK of the SYN reply has sequence number 358236701;
the first segment from the connecting side to the connected-to side has sequence number 358236700. 

If I have it enabled:

	the initial SYN has sequence number 0;

	the SYN+ACK of the initial SYN has sequence number 0;

	the ACK of the SYN reply has sequence number 0 (*not* 1!);
the first segment from the connecting side to the connected-to side has sequence number 0. 

Ronnie?