Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 3785] Some HTTP responses don't decode with TCP reassembly

Date: Fri, 25 Mar 2011 08:55:21 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3785

--- Comment #15 from Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> 2011-03-25 08:55:19 PDT ---
(In reply to comment #14)
> I synthesized a FIN and appended it to the end of the broken_http_response.cap
> file (see attached).  The response still fails to decode properly.  

There was a problem in the TCP dissector; I fixed that in rev 36330 and
scheduled the change for 1.4.5.

> I don't have the original packet capture (it's been a long time since I
> submitted this), but that capture contained a complete TCP conversation with
> SYNs, FINs, request, and response and it wasn't decoding.

Hopefully the above would fix that, too.

> Handling the case where length_remaining == reported_length_remaining seemed to
> address this problem but if that isn't the proper fix for this, that's fine by
> me.  Any idea on what the best solution would be?

I don't know how to handle the "desegment until fin, but we never see a fin"
problem.  Well, I think the answer must be to have an indication that "we
reached the end of the capture file [so there will be no more packets coming]",
but that seems complicated.

Given that your original problem probably had to do with what was fixed in rev
36330, should we close this now?

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.