Wireshark-bugs: [Wireshark-bugs] [Bug 12639] DCE/RPC dissector fragments reassembling error

Date: Thu, 21 Jul 2016 14:06:32 +0000

changed bug 12639


What Removed Added
Status UNCONFIRMED INCOMPLETE
CC   [email protected]
Ever confirmed   1

Comment # 2 on bug 12639 from
Packet 5 itself has a TCP payload length of 11376 bytes. So it contains the end
of the previous DCE/RPC packet (as shown in your screenshot) and the beginning
of a new one (as only 7696 bytes out of 11376 were "consumed" with the first
DCE/RPC fragment, the rest being exactly 3680 bytes).
I know nothing about DCE/RPC protocol itself so I'm probably missing the point
but what makes you think this is not correct? The decoding of headers seem
meaningful (frag flag, frag length).


You are receiving this mail because:
  • You are watching all bug changes.