Wireshark-bugs: [Wireshark-bugs] [Bug 8173] Exported TCP packet with invalid sequence number not

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 08 Jan 2013 22:02:06 +0000

changed bug 8173

What Removed Added
Status UNCONFIRMED RESOLVED
Resolution --- NOTABUG

Comment # 7 on bug 8173 from 
(In reply to comment #6)
> 
> Sorry for the confusion.

Not a problem...  We're always glad to help.


> There *might* be a bug about handling a new connection on the same port but
> that's a separate bug (and not what you're reporting as a bug in this report).

After looking at the tcp dissector code, it turns out that the code explicitly
treats a SYN with the same sequence number as a previous SYN as a
retransmission (and as part of the same "connection").

(Given the issues and rules about TCP "sequence number reuse" I believe this is
correct).

The comment in the tcp dissector source:
    /* If this is a SYN packet, then check if it's seq-nr is different
     * from the base_seq of the retrieved conversation. If this is the
     * case, create a new conversation with the same addresses and ports
     * and set the TA_PORTS_REUSED flag. If the seq-nr is the same as
     * the base_seq, then do nothing so it will be marked as a retrans-
     * mission later.

(Note: I would claim that a tcp stack which uses the same initial sequence
number for all connections is broken).

You are receiving this mail because:
  • You are watching all bug changes.