Wireshark-bugs: [Wireshark-bugs] [Bug 9882] New: Data on SYN Not Reassembled Correctly in Packet
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 13 Mar 2014 20:07:11 +0000
Bug ID 9882
Summary Data on SYN Not Reassembled Correctly in Packet Pane
Classification Unclassified
Product Wireshark
Version 1.10.0
Hardware x86
OS All
Status UNCONFIRMED
Severity Major
Priority Low
Component Wireshark
Assignee bugzilla-admin@wireshark.org
Reporter rucombs@cisco.com 

Created attachment 12635 [details]
Pcap with data on TCP SYN.

Build Information:
Version 1.10.0 (SVN Rev Unknown from unknown)

Copyright 1998-2013 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.18, with Cairo 1.12.14, with Pango 1.34.1,
with
GLib 2.36.3, with libpcap, with libz 1.2.7, with POSIX capabilities (Linux),
without libnl, with SMI 0.4.8, with c-ares 1.10.0, with Lua 5.1, without
Python,
with GnuTLS 3.1.11, with Gcrypt 1.5.2, with MIT Kerberos, with GeoIP, with
PortAudio V19-devel (built May  4 2013 13:59:07), with AirPcap.

Running on Linux 3.9.5-301.fc19.x86_64, with locale en_US.UTF-8, with libpcap
version 1.4.0, with libz 1.2.7, GnuTLS 3.1.11, Gcrypt 1.5.2, without AirPcap.
Intel(R) Xeon(R) CPU            5110  @ 1.60GHz

Built using gcc 4.8.1 20130603 (Red Hat 4.8.1-1).

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
Attached has a one byte overlap between 1st and 2nd data segment from client at
sequence #5.

When viewed in the bottom pane it shows "Reassembled TCP (411 bytes)" and the
start of the request is "GET /test-cgi?* HTTP/1.1"  which is incorrect.

When viewed by following the stream, it shows "Entire conversation (410 bytes)"
and the start of the request is "GET /est-cgi?* HTTP/1.1", which is correct.

You are receiving this mail because:
  • You are watching all bug changes.