Wireshark-bugs: [Wireshark-bugs] [Bug 12855] Follow TCP Stream shows duplicate stream data

Date: Mon, 03 Oct 2016 00:06:04 +0000

Comment # 10 on bug 12855 from
(In reply to Gerrit Code Review from comment #9)
> Change 18034 had a related patch set uploaded by Michael Mann:
tshark:
> follow streams should start with chunk 1.
> https://code.wireshark.org/review/18034

I took Peter's captures and looked at them in Wireshark and got different
output than TShark.  So with the above fix the TShark output for tcp9.pcap on
master (now matching Wireshark) is
===================================================================
Follow: tcp,hex
Filter: tcp.stream eq 0
Node 0: 10.0.0.1:32323
Node 1: 10.0.0.2:9
00000000  46 69 72 73 74 0a                                 First.
00000006  53 65 63 6f 6e 64 0a                              Second.
0000000D  46 6f 75 72 74 68 0a                              Fourth.
00000014  46 69 66 74 68 0a                                 Fifth.
0000001A  4c 61 73 74 0a                                    Last.
===================================================================

compared to 2.0.5 (recopied for convenience)

tshark 2.0.5:
===================================================================
Follow: tcp,hex
Filter: tcp.stream eq 0
Node 0: 10.0.0.1:32323
Node 1: 10.0.0.2:9
00000000  46 69 72 73 74 0a                                 First.
00000006  53 65 63 6f 6e 64 0a                              Second.
0000000D  54 68 69 72 64 0a                                 Third.
00000013  46 6f 75 72 74 68 0a                              Fourth.
0000001A  46 69 66 74 68 0a                                 Fifth.
===================================================================


With this, I have a harder time determining which is "better". master skips
"Third", but includes "Last".  2.0.5 skips/misses "Last".

tcp80.pcap still doesn't look wrong in master (not sure if its same issue as
OB's trace), but I'll probably start with Pascal's first attempt
(https://code.wireshark.org/review/17749).  I wasn't sure if the buggy TShark
unintentionally discouraged what could be at least a start at the proper fix.


You are receiving this mail because:
  • You are watching all bug changes.