Wireshark · Ethereal-users: Re: [Ethereal-users] Decoding of TCP sequence numbers contained within ICMP messages

[Guy Harris <gharris@xxxxxxxxx>]

Bjorn Townsend wrote:

> I was troubleshooting an issue involving path MTU discovery today and
> was looking at an ICMP Destination Unreachable packet in Ethereal
> 0.10.9. I noticed that even though the ICMP packet contained the
> source port, destination port and sequence number of the original
> datagram, Ethereal only decoded the source and destination port; the
> sequence number was recognized as being TCP data but was not decoded.

If by "decoded" you mean "analyzed", as per the TCP sequence number 
analysis, that's by design.

If by "decoded" you mean "displayed as a sequence number or ack number", 
that's not by design - and the only obvious thing I can see in the code 
that would cause it would be the requirement that the entire TCP header 
(not counting options) be present in the packet.  Is that the problem?

If we move the sequence number analysis *after* the point at which we 
put the sequence numbers into the protocol tree, we might be able to fix 
that.  Ronnie?