Erik Hjelmvik
changed
bug 12855
| What |
Removed |
Added |
| Status |
RESOLVED
|
CONFIRMED
|
| Resolution |
FIXED
|
---
|
Comment # 27
on bug 12855
from Erik Hjelmvik
I'd like to open this bug up again. I tried Wireshark 2.2.2 but it did
unfortunately not always fix the issue of showing overlapping/duplicate
packets.
Attached files:
hao123-com_packet-injection-filtered.pcap
TCP packet injection attack from my SharkFest Europe talk
https://sharkfesteurope.wireshark.org/assets/presentations16eu/10.pdf
hao123-com_packet-injection-filtered.png
Screenshot of Wireshark 2.2.2's Follow TCP Stream showing both the injected
packet and the real packet even though they have the same TCP sequence number.
Correct behaviour would be to skip the first 74 bytes of the second overlap,
since we have already read 74 bytes from the first overlapping segment.
You are receiving this mail because:
- You are watching all bug changes.