Wireshark-users: Re: [Wireshark-users] Possible bug in Wireshark/Tshark Conversations Counters

From: Sake Blok <sake@xxxxxxxxxx>
Date: Sat, 7 Apr 2007 10:20:29 +0200

On Sat, Apr 07, 2007 at 08:48:21AM +0100, Tim Everitt wrote:
> I believe that some of the Conversation counters do not operate correctly 
> when packets have been captured with a packet length limit (or -s in 
> tshark).
> [...]
> I suspect that the Ethernet and IPv4 counters are not counting truncated 
> packets.

I did a little check myself and I think you are right. I retrieved one 
image over http. Once tihe no packet limiting and once with full packets.
There are 18 packets, the conversationlist only shows 11 at eth and ip.
There are indeed 7 frames in my trace which are truncated.

> I have checked back using an old software revision (ethereal 0.10.13) and 
> the numbers worked correctly then.
> 
> Please can someone else check this to see if my report above is correct.

Could you please file a bug for this on http://bugs.wireshark.org?

Cheers,


Sake