Ethereal-users: Re: [Ethereal-users] Problem with tethereal -z proto, colinfo, tcp.analysis.xxxx

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 1 Oct 2003 11:26:39 -0700

On Sep 30, 2003, at 8:58 PM, Jeff Dubis wrote:

Does anyone know why tethereal 0.9.15 does not seem to produce the additional columns for tcp.analysis and tcp.options parameters such as tcp.analysis.ack_rtt or tcp.options.sack ? 

Other columns such as tcp.flags.syn are added to the packet without a problem.

If you hadn't added the second paragraph, my first suggestion would have been "perhaps because the filter in the -z flag didn't have the field in it" - a not-exactly-obvious characteristic of the -z flag is that the filter has to include the fields that are being added to the Info column, as otherwise the display filter code isn't "primed" to fetch their values. (I'd consider that a misfeature, at best, and arguably a bug.)

However, as you did, that wasn't the problem. The problem is probably that you don't have TCP sequence number analysis turned on; try running Tethereal with the flag "-o tcp.analyze_sequence_numbers:true".