Wireshark-bugs: [Wireshark-bugs] [Bug 12597] Export filtered displayed packets not saving SCTP f

Date: Thu, 14 Jul 2016 02:50:51 +0000

changed bug 12597


What Removed Added
Status UNCONFIRMED CONFIRMED
Ever confirmed   1

Comment # 3 on bug 12597 from
OK, I see the problem, I'm just not sure what to do about it.

The Diameter message in question (frame 3050) is composed of 2 SCTP fragments:

2) Frame 2752
3) Frame 3050

The problem is that the SCTP fragment in frame 2752 is itself composed of 2 IP
fragments:

1) Frame 2751
2) Frame 2752

Only frame 3050 passes the display filter so only the fragments used to
reassemble it are marked as "depended upon" (so in this case frame 2752 is so
marked).  The problem is there's no recursion (or similar) from frame 2752 back
to frame 2751.

Unfortunately the way this feature (saving depended-upon frames) works is by
having using the reassembly code's knowledge of the frames that were necessary
to construct the PDU that passed the display filter (frame 3050 in this case). 
I don't think we still have similar knowledge about frame 2752 at this
point--or if we do we don't have access to it.


You are receiving this mail because:
  • You are watching all bug changes.