Wireshark · Ethereal-users: Re: [Ethereal-users] TCP stream shows different stuff?

[Guy Harris <guy@xxxxxxxxxx>]

> However, the regular list view in ethereal doesn't show any difference
> between good and bad PORT packets. But TCP Stream from Tools menu
> displays something completely different. Good packets look the same in
> both views, but for bad packets TCP Stream view prints some garbage:
> 
>   0 Feb 13 20:02 bussys
> 
> preceded with two new lines. If this is true, that would explain why my
> PORT commands don't work, but my question is to whom I can believe and
> why do they display different stuff.

What does the raw data in the hex/ASCII dump window show?  Does it agree
with the stuff that shows up in the protocol tree window (middle
window)?

If so, that's what actually went over the network, and, if that doesn't
match what's in the TCP Stream window, there's presumably a bug in the
TCP Stream code.

If not, then there's a bug somewhere in the FTP dissector, so that it's
not putting the right stuff into the protocol tree.

In either of those presumed-bug cases, could you send us the capture
file, so we can try to figure out what the bug is?