Wireshark-dev: Re: [Wireshark-dev] strange packet dissection order when loading the 1st pcap fi
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Mon, 25 Jun 2012 14:26:29 -0600
---- On Mon, 25 Jun 2012 14:08:22 -0600 wsgd  wrote ---- 

>Summary : 
>- packets are dissected twice (3 times for packet 1) 
>- in the good order for 1st sequence 
>- not in the good order for the 2nd sequence 
> packet 4 dissected just after packet 1 
> 
> 
>This happens on wireshark : 1.8.0, 1.6.0, 1.6.1, 1.6.2, 1.4.7 
> 
>This does not happen : 
>- on wireshark 1.2.18 
>- when wireshark is started by double-clicking the pcap file 
>- when opening 2nd, 3rd ... pcap file 
>- if pcap file has less than 8 packets 

The new behavior is probably because the new packet list became default starting with release 1.4 (and many SVN revisions before that).  There are no guarantees of what order packets will be dissected in, although the first time through is usually (always?) sequential.  The new packet list focuses dissection on the currently displayed packets, so if you move the scroll bar (or even mouse cursor), it may need to re-dissect packets.