Wireshark-bugs: [Wireshark-bugs] [Bug 12855] Follow TCP Stream shows duplicate stream data
Comment # 10
on bug 12855
from Michael Mann
(In reply to Gerrit Code Review from comment #9)
> Change 18034 had a related patch set uploaded by Michael Mann:
tshark:
> follow streams should start with chunk 1.
> https://code.wireshark.org/review/18034
I took Peter's captures and looked at them in Wireshark and got different
output than TShark. So with the above fix the TShark output for tcp9.pcap on
master (now matching Wireshark) is
===================================================================
Follow: tcp,hex
Filter: tcp.stream eq 0
Node 0: 10.0.0.1:32323
Node 1: 10.0.0.2:9
00000000 46 69 72 73 74 0a First.
00000006 53 65 63 6f 6e 64 0a Second.
0000000D 46 6f 75 72 74 68 0a Fourth.
00000014 46 69 66 74 68 0a Fifth.
0000001A 4c 61 73 74 0a Last.
===================================================================
compared to 2.0.5 (recopied for convenience)
tshark 2.0.5:
===================================================================
Follow: tcp,hex
Filter: tcp.stream eq 0
Node 0: 10.0.0.1:32323
Node 1: 10.0.0.2:9
00000000 46 69 72 73 74 0a First.
00000006 53 65 63 6f 6e 64 0a Second.
0000000D 54 68 69 72 64 0a Third.
00000013 46 6f 75 72 74 68 0a Fourth.
0000001A 46 69 66 74 68 0a Fifth.
===================================================================
With this, I have a harder time determining which is "better". master skips
"Third", but includes "Last". 2.0.5 skips/misses "Last".
tcp80.pcap still doesn't look wrong in master (not sure if its same issue as
OB's trace), but I'll probably start with Pascal's first attempt
(https://code.wireshark.org/review/17749). I wasn't sure if the buggy TShark
unintentionally discouraged what could be at least a start at the proper fix.
You are receiving this mail because:
- You are watching all bug changes.
