Wireshark-dev: [Wireshark-dev] Changing a TCP flags letter to match tcpdump

Date Prev · Date Next · Thread Prev · Thread Next
From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Fri, 7 Nov 2025 15:51:25 +0100
Hi,

Should we change the letter used for indicating the Congestion window reduced (CWR) flag from ‘C’ to ‘W’, in order to match the output of tcpdump (according to [1]) ? 
Or does this break something unforseen?

@@ -1088,11 +1088,11 @@ static char *
 tcp_flags_to_str_first_letter(wmem_allocator_t *scope, const struct tcpheader *tcph)
 {
     wmem_strbuf_t *buf = wmem_strbuf_new(scope, "");
     unsigned i;
     const unsigned flags_count = 12;
-    static const char first_letters[] = "RRRACEUAPRSF";
+    static const char first_letters[] = "RRRAWEUAPRSF";
     static const char digits[] = "01234567";
 
     /* upper three bytes are marked as reserved ('R'). */
     for (i = 0; i < flags_count; i++) {
         if (tcph->th_use_ace && 3 <= i && i <= 5) {


PS: I know Ack is an ‘A’, rather than a ‘.’ as in tcpdump, but I guess that does not stand out enough between the ‘dot’ characters in the TCP flags string.

Thanks,
Jaap