https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5727
--- Comment #1 from Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx> 2011-02-25 10:55:48 MST ---
This comment from epan/dissectors/packet-tftp.c explains why this is happening.
Someone will have to take a closer look to see if this can be improved.
/*
* The first TFTP packet goes to the TFTP port; the second one
* comes from some *other* port, but goes back to the same
* IP address and port as the ones from which the first packet
* came; all subsequent packets go between those two IP addresses
* and ports.
*
* If this packet went to the TFTP port, we check to see if
* there's already a conversation with one address/port pair
* matching the source IP address and port of this packet,
* the other address matching the destination IP address of this
* packet, and any destination port.
*
* If not, we create one, with its address 1/port 1 pair being
* the source address/port of this packet, its address 2 being
* the destination address of this packet, and its port 2 being
* wildcarded, and give it the TFTP dissector as a dissector.
*/
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.