Wireshark-bugs: [Wireshark-bugs] [Bug 6325] Wireshark netflow dissector complains there is no te
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6325
Bill Meier <wmeier@xxxxxxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Platform|x86 |All
Resolution| |FIXED
OS/Version|Windows XP |All
Severity|Major |Normal
--- Comment #5 from Bill Meier <wmeier@xxxxxxxxxxx> 2011-11-23 23:08:15 EST ---
(In reply to comment #4)
>
> I've also made another change so that it's (somewhat) less likely that a
> template will be ignored (but still possible).
>
> However, the proper fix for the issue related to ignoring a template requires a
> more extensive change (upcoming) which will not be backported to Wireshark 1.6.
Done in SVNs #39995 & #39996 in Dev ....
A template will be now be skipped (not saved for future dissection) when there
are "too many" fields (specified by a CFLOW preference) or if a template with
the same "name" has already been seen.
Note that this means that a replacement template on a connection which
represents a change (i.e., is re-sent with different fields) will be ignored
and thus dissection of following data packets using that replacement template
will be incorrect.
I'm guessing that resending a template with different fields is not something
that normally happens.
If needed, handling this case can be done as a future enhancement.
P.S. Thanks for the report !
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
