Wireshark-bugs: [Wireshark-bugs] [Bug 12855] Follow TCP Stream shows duplicate stream data
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sat, 17 Sep 2016 14:21:03 +0000

changed bug 12855


What Removed Added
CC   peter@lekensteyn.nl

Comment # 4 on bug 12855 from 
Created attachment 14927 [details]
crafted packet with retransmitted, out-of-order and missing packets

Another example where the new Follow TCP method produces strange
results. This capture was created using Scapy, source is at
https://git.lekensteyn.nl/peter/wireshark-notes/tree/crafted-pkt/make-tcp.py?id=c77414b056e7c9bcc91c9256b463c75e4992e076

tshark -r tcp9.pcap -z follow,tcp,hex,0

tshark 2.0.5:
===================================================================
Follow: tcp,hex
Filter: tcp.stream eq 0
Node 0: 10.0.0.1:32323
Node 1: 10.0.0.2:9
00000000  46 69 72 73 74 0a                                 First.
00000006  53 65 63 6f 6e 64 0a                              Second.
0000000D  54 68 69 72 64 0a                                 Third.
00000013  46 6f 75 72 74 68 0a                              Fourth.
0000001A  46 69 66 74 68 0a                                 Fifth.
===================================================================

tshark master:
===================================================================
Follow: tcp,hex
Filter: tcp.stream eq 0
Node 0: 10.0.0.1:32323
Node 1: 10.0.0.2:9
00000006  53 65 63 6f 6e 64 0a                              Second.
0000000D  46 6f 75 72 74 68 0a                              Fourth.
00000014  46 69 66 74 68 0a                                 Fifth.
0000001A  4c 61 73 74 0a                                    Last.
===================================================================

You are receiving this mail because:
  • You are watching all bug changes.