Hello all,
For your intelligency and for comments.
The following tests shows the packet dissection order during the load of
a pcap file.
The result is put on 2 lines for readibility.
Load a pcap file just after wireshark opening.
* pcap file with 8 packets
1 2 3 4 5 6 7 8
1 4 1 2 3 5 6 7 8
* pcap file with 10 packets
1 2 3 4 5 6 7 8 9 10
1 4 1 2 3 5 6 7 8 9 10
* pcap file with 15 packets
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
1 4 1 2 3 5 6 7 8 9 10 11 12 13 14 15
Summary :
- packets are dissected twice (3 times for packet 1)
- in the good order for 1st sequence
- not in the good order for the 2nd sequence
packet 4 dissected just after packet 1
This happens on wireshark : 1.8.0, 1.6.0, 1.6.1, 1.6.2, 1.4.7
This does not happen :
- on wireshark 1.2.18
- when wireshark is started by double-clicking the pcap file
- when opening 2nd, 3rd ... pcap file
- if pcap file has less than 8 packets
I do not know if it is an invalid order, a problem.
But it's strange !
Olivier