https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4288
Summary: Incorrect display of stream data using "Follow tcp
stream" option.
Product: Wireshark
Version: 1.3.x (Experimental)
Platform: Other
OS/Version: All
Status: NEW
Severity: Major
Priority: Low
Component: Wireshark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: stasikos@xxxxxxxxx
Created an attachment (id=4019)
--> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=4019)
pcap capture with both streams
Build Information:
$ wireshark -v
wireshark 1.3.2
Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled with GTK+ 2.18.3, with GLib 2.22.2, with libpcap 1.0.0, with libz
1.2.3.3, with POSIX capabilities (Linux), with libpcre 7.8, with SMI 0.4.8,
without c-ares, with ADNS, with Lua 5.1, without Python, with GnuTLS 2.8.3,
with
Gcrypt 1.4.4, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built
Jun
20 2009 13:28:51), without AirPcap, with new_packet_list.
Running on Linux 2.6.31-15-generic, with libpcap version 1.0.0, GnuTLS 2.8.3,
Gcrypt 1.4.4.
Built using gcc 4.4.1.
--
If there is two different tcp streams in one dump with equivalent endpoints
(ie.
connection 1: i1:p1 <-> i2:p2
connection 2: i1:p1 <-> i2:p2)
you are able to filter stream using filter like tcp.stream eq <stream_id>, and
it works correctly, but it is possible to see mix from stream1 and stream2 data
in Follow Tcp Stream window (especially, if streams have different length).
Reproduced in 1.2.2 and 1.3.2. (dump with both streams is attached)
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.