Wireshark-bugs: [Wireshark-bugs] [Bug 9783] New: tshark -z follow stops after missing or broken

Date: Mon, 17 Feb 2014 09:52:11 +0000
Bug ID 9783
Summary tshark -z follow stops after missing or broken package
Classification Unclassified
Product Wireshark
Version unspecified
Hardware x86
OS Windows 7
Status UNCONFIRMED
Severity Major
Priority Low
Component TShark
Assignee [email protected]
Reporter [email protected]

Build Information:
TShark 1.10.5 (SVNRev 54262 from /trunk-1.10)

Copyright 1998-2013 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.34.1, with WinPcap (4_1_3), with libz 1.2.5,
without POSIX capabilities, without libnl, with SMI 0.4.8, with c-ares 1.9.1,
with Lua 5.1, without Python, with GnuTLS 2.12.18, with Gcrypt 1.4.6, without
Kerberos, with GeoIP.

Running on 64-bit Windows 7 Service Pack 1, build 7601, without WinPcap.
Intel(R) Core(TM)2 Duo CPU     E7400  @ 2.80GHz, with 4029MB of physical
memory.


Built using Microsoft Visual C++ 10.0 build 40219

--
Using tshark with -z follow,tcp,ascii,<stream number> stops if there is a
missing or broken file in the stream.

For example, if I have a stream containing 12000 bytes with package numbers
reaching up to 4000 if number 300 is filed as missing or broken in wireshark,
the follow option will stop displaying ascii output right after package 299 and
skip all other packages. 

Further testing showed me that this problem also appears in wireshark, when I
use "follow tcp stream" and is the same for Linux and Windows. I tested this
with the last 5 Stables of Wireshark and the current Development Version (in
which -z follow is not working at all, but that is a different problem).

Please help me fix this, for I need this working VERY badly. 

In the meantime a workaround would be appreciated.


You are receiving this mail because:
  • You are watching all bug changes.