Wireshark mailing list archives

Is anyone out there seeing ‘wiredness’ with how wireshark 1.6.7 is tracking TCP streams?


From: <Tim.Poth () bentley com>
Date: Mon, 16 Apr 2012 21:54:38 +0000

Is anyone out there seeing ‘wiredness’ with how wireshark 1.6.7 is tracking TCP streams? I have an intermittent issue 
where tcp packets that I am sure are part of the same stream get flagged as being in different streams.

EG. SYN packet to start the stream, stream 126

[cid:image001.png@01CD1BF9.2152BED0]

EG. ACK packet 7 packets in to the stream now with stream # 127.

[cid:image002.png@01CD1BF9.2152BED0]

I THINK the problem is the sequence number, I have relative sequence numbers turned on but the number for this frame 
seems OFF. If I reopen the capture or reload it the issue goes away and then a few captures later pops up again.
I tried searching but ether there is no bug filed or I can think of the right terms to search on. I just wanted to know 
if it’s a ME thing before filing a bug and wasting someone’s time.
Thanks
tim

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

Current thread: