Wireshark-bugs: [Wireshark-bugs] [Bug 2722] Follow TCP stream detects FIN flags as missing byte

From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 1 Oct 2008 23:11:29 -0700 (PDT)

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2722





--- Comment #7 from Sake <sake@xxxxxxxxxx>  2008-10-01 23:11:28 PDT ---
Hi Rodrigo,

I'm sorry I did not remember that you were unable to share the file because of
confidentiality. Actually I'm only interested in the TCP info so that I can
deduct what happens (or build a tracefile myself). Could you run the following
command on the file?

$ tshark -r <file> -R <filter-to-select-only-the-stream-you-are-looking-at> -T
fields -e tcp.srcport -e tcp.dstport -e tcp.flags -e tcp.seq -e tcp.ack -e
tcp.len

It gives output as follows:

13374   80      0x02    0               0
80      13374   0x12    0       1       0
13374   80      0x10    1       1       0
13374   80      0x18    1       1       142
80      13374   0x11    827     143     0
13374   80      0x10    143     1       0
80      13374   0x18    1       143     826
13374   80      0x11    143     828     0
80      13374   0x10    828     144     0

That would help a lot in pinpointing this issue, without displaying sensitive
info :-)

Cheers,
Sake


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.