Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 2712] problems recreating a file from capture

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2712





--- Comment #3 from youngba@xxxxxxxx  2008-07-14 17:11:44 PDT ---
> Created an attachment (id=2007)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=2007) [details]
> packet capture of ftp-data that should create a pdf file
> 
> Build Information:
> Version 1.0.2 (SVN Rev 25698)
> 
> Copyright 1998-2008 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
> This is free software; see the source for copying conditions. There is NO
> warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
> 
> Compiled with GTK+ 2.12.8, with GLib 2.14.6, with WinPcap (version unknown),
> with libz 1.2.3, without POSIX capabilities, with libpcre 7.0, with SMI 0.4.8,
> with ADNS, with Lua 5.1, with GnuTLS 2.3.8, with Gcrypt 1.4.1, with MIT
> Kerberos, with PortAudio V19-devel, with AirPcap.
> 
> Running on Windows XP Service Pack 2, build 2600, with WinPcap version 4.0.2
> (packet.dll version 4.0.0.1040), based on libpcap version 0.9.5, without
> AirPcap.
> 
> Built using Microsoft Visual C++ 6.0 build 8804
> 
> --
> When trying to recreate a PDF document from a large packet capture, the file
> size is wrong and file is corrupted.
> 
> First noticed in Wireshark 0.99.8.  Works in 0.99.7 and below.  Hasn't worked
> in any later release.
> 
> I have a large packet capture that was created for a class for hands on
> practice exercises.  In this packet capture, there was a PDF document
> transferred using FTP.  Recreating the TCP Stream for just the FTP-DATA, I get
> 848621 bytes for version 0.99.7 and 840077 bytes for version 0.99.8 and above.  
> 
> attached is the ftp-data packet capture.  If the file is recreated correctly,
> it should be a pdf file titled IPSwitch WS_FTP Server User's guide but as
> stated, this hasn't worked after version 0.99.7.
> 

(In reply to comment #0)
> Created an attachment (id=2007)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=2007) [details]
> packet capture of ftp-data that should create a pdf file
> 
> Build Information:
> Version 1.0.2 (SVN Rev 25698)
> 
> Copyright 1998-2008 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
> This is free software; see the source for copying conditions. There is NO
> warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
> 
> Compiled with GTK+ 2.12.8, with GLib 2.14.6, with WinPcap (version unknown),
> with libz 1.2.3, without POSIX capabilities, with libpcre 7.0, with SMI 0.4.8,
> with ADNS, with Lua 5.1, with GnuTLS 2.3.8, with Gcrypt 1.4.1, with MIT
> Kerberos, with PortAudio V19-devel, with AirPcap.
> 
> Running on Windows XP Service Pack 2, build 2600, with WinPcap version 4.0.2
> (packet.dll version 4.0.0.1040), based on libpcap version 0.9.5, without
> AirPcap.
> 
> Built using Microsoft Visual C++ 6.0 build 8804
> 
> --
> When trying to recreate a PDF document from a large packet capture, the file
> size is wrong and file is corrupted.
> 
> First noticed in Wireshark 0.99.8.  Works in 0.99.7 and below.  Hasn't worked
> in any later release.
> 
> I have a large packet capture that was created for a class for hands on
> practice exercises.  In this packet capture, there was a PDF document
> transferred using FTP.  Recreating the TCP Stream for just the FTP-DATA, I get
> 848621 bytes for version 0.99.7 and 840077 bytes for version 0.99.8 and above.  
> 
> attached is the ftp-data packet capture.  If the file is recreated correctly,
> it should be a pdf file titled IPSwitch WS_FTP Server User's guide but as
> stated, this hasn't worked after version 0.99.7.
> 

(In reply to comment #2)
> OK, the following patch was not included in 1.0.x releases:
> 
> r25289 | sake | 2008-05-14 00:45:04 +0200 (Wed, 14 May 2008) | 7 lines
> 
> Fix the tcp reassembly routine in epan/follow.c :
> 
> - Don't do '<gulongvar>-<gulongvar> > 0' as it will always be true :-)
> - Handle the case where a segment is partially retransmitted
> 
> 
> I have put r25289 on the list for release 1.0.3
> (see: http://wiki.wireshark.org/Development/Roadmap )
> 
> Are you OK with closing this bug?
> 

Yes, I am OK with closing it.


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.