Wireshark-bugs: [Wireshark-bugs] [Bug 11414] Match conversation tracking on ICMP

Date: Thu, 01 Oct 2015 02:13:21 +0000

changed bug 11414


What Removed Added
CC   [email protected]

Comment # 5 on bug 11414 from
This seems to be an issue outside of ICMP.  Others probably understand the
internals of the GUI (maybe dumpcap?) more than I do, so I'll just explain what
I saw.

I added debugging information to record every packet that had been processed in
both the frame and ICMP dissectors stored as a list and set a breakpoint when
the "no response found" was to be added to the column info.

The ICMP dissector will only execute the "no response found" logic if the
packet has been visited before ((pinfo)->fd->flags.visited).

When this bug can been duplicated, the ICMP request frame has been processed
twice (so the visited flag is set on the second time it's processed) and the
ICMP response has not been processed at all.  So it seems in live captures,
processing "every" packet first once can't always apply.
The GUI must periodically say "these are all the packets I've got, so run a
second pass on them".  If the last packet in that list is an ICMP request, the
INFO column will list that ICMP the response hasn't been found.


You are receiving this mail because:
  • You are watching all bug changes.