https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3101
--- Comment #2 from alantu@xxxxxxxx 2008-12-09 01:37:32 PDT ---
After more testing, data.data does not display when the packet/TCP segment is
a duplicate. If this is the intended effect, so be it (though I still think
this is a bug.)
Command: tshark -r bug.pcap -T fields -e frame.number -e ip.src -e tcp.srcport
-e ip.dst -e tcp.dstport -e tcp.flags -e tcp.seq -e tcp.len -e data.data
frame.number ip.src tcp.srcport ip.dst tcp.dstport tcp.flags
tcp.seq tcp.len data.data Comment
1 10.0.0.2 4735 10.0.0.1 443 0x02 0 0
SYN
2 10.0.0.1 443 10.0.0.2 4735 0x12 0 0
SYN-ACK
3 10.0.0.2 4735 10.0.0.1 443 0x10 1 0
ACK
4 10.0.0.2 4735 10.0.0.1 443 0x18 1 39
... data
5 10.0.0.1 443 10.0.0.2 4735 0x10 1 0
6 10.0.0.2 4735 10.0.0.1 443 0x18 40 ...
data
7 10.0.0.1 443 10.0.0.2 4735 0x10 1 0
8 10.0.0.1 443 10.0.0.2 4735 0x18 1 1
b4 1-byte response
9 10.0.0.1 443 10.0.0.2 4735 0x18 1 1
duplicate, data.data displays empty
tcp.relative_sequence_numbers set to true or false with -o has no effect
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.