Wireshark-bugs: [Wireshark-bugs] [Bug 10780] New: IPv6 Conversation List Includes Conversations
| Bug ID |
10780
|
| Summary |
IPv6 Conversation List Includes Conversations Not Present In Capture File
|
| Product |
Wireshark
|
| Version |
1.12.2
|
| Hardware |
x86-64
|
| OS |
Linux (other)
|
| Status |
UNCONFIRMED
|
| Severity |
Major
|
| Priority |
Low
|
| Component |
Dissection engine (libwireshark)
|
| Assignee |
bugzilla-admin@wireshark.org
|
| Reporter |
tom@qacafe.com
|
Created attachment 13325 [details]
Capture with incorrect IPv6 Conversations
Build Information:
$ tshark -v
TShark 1.12.2 (Git Rev Unknown from unknown)
Copyright 1998-2014 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GLib 2.36.3, with libpcap, without libz, without POSIX
capabilities, without libnl, without SMI, without c-ares, without ADNS, without
Lua, without Python, without GnuTLS, without Gcrypt, without Kerberos, without
GeoIP.
Running on Linux 3.10.0-123.8.1.el7.x86_64, with locale en_US.UTF-8, with
libpcap version 1.5.3.
Intel(R) Core(TM) i7-3615QM CPU @ 2.30GHz
Built using gcc 4.8.2 20140120 (Red Hat 4.8.2-16).
--
The OS I am using is CentOS 7.0.
When I use tshark to view the IPv6 Conversation List it is listing
conversations that were not present in the capture file. The IPv6 Addresses it
prints for the conversations were also not present in the Capture file and
these addresses change each time I run the command.
I've attached a capture named "ipv6_conversations_with_tcp_reassembly.pcapng"
which exhibits this behavior. I have also noticed that the
tcp.desgement_tcp_streams preference can effect the output as well. When this
is set to TRUE, there are two extra conversations found in the attached file.
When this is set to FALSE there is only one extra conversation found.
Here is the tshark output I am receiving when listing the IPv6 Conversations.
In both cases only the first conversation listed is correct:
$ tshark -r ipv6_conversations_with_tcp_reassembly.pcapng -q -z conv,ipv6 -o
tcp.desegment_tcp_streams:FALSE
================================================================================
IPv6 Conversations
Filter:<No Filter>
| <- | | ->
| | Total | Relative | Duration |
| Frames Bytes | | Frames
Bytes | | Frames Bytes | Start | |
fe80::7a4b:87ff:fe0b:51d6 <-> 2002:4adc:e543:1:a00:27ff:fedd:9e13 116
164641 90 11466 206 176107 0.000276000 0.5940
c0:180d:c47f:0:a00:27ff:fedd:9e13 <-> ::100:0:fe0b:51d6 1 94
0 0 1 94 0.000000000 0.0000
================================================================================
$ tshark -r ipv6_conversations_with_tcp_reassembly.pcapng -q -z conv,ipv6 -o
tcp.desegment_tcp_streams:TRUE
================================================================================
IPv6 Conversations
Filter:<No Filter>
| <- | | ->
| | Total | Relative | Duration |
| Frames Bytes | | Frames
Bytes | | Frames Bytes | Start | |
fe80::7a4b:87ff:fe0b:51d6 <-> 2002:4adc:e543:1:a00:27ff:fedd:9e13 115
163127 90 11466 205 174593 0.000276000 0.5940
50:149b:ea7f:0:7a4b:87ff:fe0b:51d6 <-> ::100:0:fedd:9e13 1 1514
0 0 1 1514 0.212604000 0.0000
50:149b:ea7f:0:a00:27ff:fedd:9e13 <-> ::100:0:fe0b:51d6 1 94
0 0 1 94 0.000000000 0.0000
================================================================================
If there is any extra information or anything I can do to help just let me
know.
Thank you!
You are receiving this mail because:
- You are watching all bug changes.
