http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1110
------- Comment #14 from pierre.juhen@xxxxxxxxxx 2006-09-27 19:18 GMT -------
(In reply to comment #12)
> Change 19334 should fix this problem. I no longer see problems with either of
> the pcap files attached to this bug.
>
> The line in question from the tata.pcap export now reads:
>
> <field name="tcp.analysis.duplicate_ack" showname="This is a TCP duplicate ack"
> size="0" pos="34" show="" value="""/>
>
> I notice that there is a code path where the show attribute but not the value
> attribute will be written, and this happens for some of the fields from
> tata.pcap, e.g.
>
> <field name="tcp.analysis.duplicate_ack_frame" showname="Duplicate to the ACK
> in frame: 1" size="0" pos="34" show="1"/>
>
> This will be true of any "generated" field, where you can filter on the field
> "field == <value>", but no actual bytes are selected in the hex pane. I don't
> think anyone has complained about this though.
>
>
> Please test and close this bug.
>
I applied the change. It doesn't work for me. See attachment "titi.pcap"
Here the output I got :
<field show="SEQ/ACK analysis" size="0" pos="34" value="">
<field name="tcp.analysis.flags" showname="TCP Analysis Flags" size="20"
pos="34" show="00:50:bd:d3:2b:5f:ae:51:cb:a0:50:10:3c:00:39:da:00:00" value="
d9760050bdd32b5fae51cba050103c0039da0000">
<field name="tcp.analysis.duplicate_ack" showname="This is a TCP
duplicate ack" size="0" pos="34" show="f"7w�f"7tcp.options.time_s
tamp == 1"/>
</field>
<field name="tcp.analysis.duplicate_ack_num" showname="Duplicate ACK #:
1" size="0" pos="34" show="1"/>
<field name="tcp.analysis.duplicate_ack_frame" showname="Duplicate to the
ACK in frame: 1" size="0" pos="34" show="1"/>
</field>
I think I can't close this bug.
--
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.