Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 4288] New: Incorrect display of stream data using "Follow

Date: Thu, 3 Dec 2009 05:56:46 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4288

           Summary: Incorrect display of stream data using "Follow tcp
                    stream" option.
           Product: Wireshark
           Version: 1.3.x (Experimental)
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: Major
          Priority: Low
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: stasikos@xxxxxxxxx


Created an attachment (id=4019)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=4019)
pcap capture with both streams

Build Information:
$ wireshark -v
wireshark 1.3.2

Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.18.3, with GLib 2.22.2, with libpcap 1.0.0, with libz
1.2.3.3, with POSIX capabilities (Linux), with libpcre 7.8, with SMI 0.4.8,
without c-ares, with ADNS, with Lua 5.1, without Python, with GnuTLS 2.8.3,
with
Gcrypt 1.4.4, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built
Jun
20 2009 13:28:51), without AirPcap, with new_packet_list.

Running on Linux 2.6.31-15-generic, with libpcap version 1.0.0, GnuTLS 2.8.3,
Gcrypt 1.4.4.

Built using gcc 4.4.1.

--
If there is two different tcp streams in one dump with equivalent endpoints
(ie. 
connection 1: i1:p1 <-> i2:p2
connection 2: i1:p1 <-> i2:p2)
you are able to filter stream using filter like tcp.stream eq <stream_id>, and
it works correctly, but it is possible to see mix from stream1 and stream2 data
in Follow Tcp Stream window (especially, if streams have different length). 
Reproduced in 1.2.2 and 1.3.2. (dump with both streams is attached)

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.