Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 2533] EBCDIC display for TN3270 packet

Date: Fri, 17 Jul 2009 12:02:07 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2533





--- Comment #16 from Bill Meier <wmeier@xxxxxxxxxxx>  2009-07-17 12:02:07 PDT ---
(In reply to comment #15)

> > Am I doing something wrong when trying to display this capture ??
> > 
> 
> No, you're doing nothing wrong. The problem with the first capture is that it
> is partial. It is missing the telnet negotiation at the start so the TELNET
> dissector has not been able to determine that it is a TN3270 session and pass
> it on to the TN3270 dissector. My results match yours, and the results are as
> expected. It is not possible for wireshark to identify a TN3270 session from a
> mid-stream capture, it needs to get the beginning of the session to know that
> the rest of it contains TN3270 data for dissection.
> 

OK.

My followup question: Is there a reason then why tn3270 is registered for
"decode-as" ?

I was sort of expecting that if I used decode-as to explicitly indicate that a
connection is tn3270 that then everything might work.

Using decode-as alters the summary pane and the packet-details pane but there's
no "packet-details" for tn3270.

Is the negotiation required to be able to show the details for a partial
session ?


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.