Wireshark-bugs: [Wireshark-bugs] [Bug 8606] TCP segment of a reassembled PDU (wowza)
Comment # 3
on bug 8606
from David Peterson
Hey Pascal. Sure. All of the traffic between these 2 servers is supposed to
be http so anything that is listed as TCP is incorrectly assembled.
HTTP requests that look like line No. 56 @ 0.145176: GET
/liveedge/_definst_/4/1/2000_hi.stream/chunklist.m3u8? (i.e. anything with
chunklist) do indeed get an HTTP 200 OK response assembled properly (response
is ascii with content type of application/vnd.apple.mpegurl).
However HTTP requests that look like line No. 162 @ 5.222356: GET
/liveedge/_definst_/4/1/2000_lo.stream/media_4262.ts? do not get a HTTP 200 OK
response assembled. The actual response is binary content-type mpegts and I
assume is buried in all that TCP protocol packets left un-assembled into HTTP
response. The response is video of at least 500k size so that massive amount
of TCP packets at the bottom of the capture is probably where the HTTP response
is.
Also, just to be clear. I used tshark to capture this traffic between 2 RHEL
linux servers. I opened the capture on my OSX laptop running the latest 1.9.2
Rev 48626 wireshark version.
The linux capture version that was installed into the RHEL server via a "yum
install wireshark-gnome" is:
wireshark -v
wireshark 1.2.15
Copyright 1998-2011 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled with GTK+ 2.18.9, (64-bit) with GLib 2.22.5, with libpcap 1.0.0, with
libz 1.2.3, without POSIX capabilities, with libpcre 7.8, with SMI 0.4.8,
without c-ares, without ADNS, without Lua, with GnuTLS 2.8.5, with Gcrypt
1.4.5,
with MIT Kerberos, without GeoIP, without PortAudio, without AirPcap.
Running on Linux 2.6.32-279.22.1.el6.x86_64, with libpcap version 1.0.0, GnuTLS
2.8.5, Gcrypt 1.4.5.
Built using gcc 4.4.6 20110731 (Red Hat 4.4.6-3).
You are receiving this mail because:
- You are watching all bug changes.
