Wireshark-users: Re: [Wireshark-users] HTTP Filter for 401 response

From: Sake Blok <sake@xxxxxxxxxx>
Date: Wed, 3 Oct 2007 19:12:14 +0200

Hi Steve,

I fixed this in SVN 23061, in a couple of hours there should be
an automated build with this number (or higher) that you might
try. They can be found at http://www.wireshark.org/download/automated/

Cheers,


Sake


On Mon, Sep 24, 2007 at 03:18:00PM -0500, Steve Crowl wrote:
> Will do. Thanks for the speedy response and workaround.
> Steve
> 
> Sake Blok wrote:
> >Steve,
> > 
> >Wireshark is unable to reassemble these packets it seems. If you 
> >disable "Allow subdissector to reassemble TCP streams" in the tcp 
> >protocol preferences, the HTTP-401 is indeed shown. This allows you to 
> >filter on http or http.response.code==401 as a workaround.
> > 
> >Could you file this as a bug on http://bugzilla.wireshark.org, 
> >mentioning that http-reassembly does not work correctly in this case 
> >and attach the tracefile to the bug?
> > 
> >Thanks, Cheers,
> > 
> > 
> >Sake
> >
> >    ----- Original Message -----
> >    *From:* Steve Crowl <mailto:stevenc@xxxxxxxxxxxxx>
> >    *To:* Community support list for Wireshark
> >    <mailto:wireshark-users@xxxxxxxxxxxxx>
> >    *Sent:* Monday, September 24, 2007 8:33 PM
> >    *Subject:* Re: [Wireshark-users] HTTP Filter for 401 response
> >
> >    Hi Sake. Yes, I can see HTTP/1.1 200 OK messages for example. The
> >    attached capture file contains the 401. All boxes are checked for
> >    HTTP preferences with Alternate TCP port = 0; all boxes checked
> >    for TCP except Try heuristic sub-dissector first.
> >    Thanks,
> >    Steve
> >
> >    Sake Blok wrote:
> >>    Hi Steve,
> >>
> >>    Does it show other http responses as HTTP? If so, could you send in a 
> >>    little capture file (just the tcp stream containing the 401) that 
> >>    shows this behaviour? If not, what are your settings in the tcp and 
> >>    http protocol preferences?
> >>
> >>    Cheers,
> >>
> >>
> >>    Sake
> >>    ----- Original Message ----- 
> >>    From: <stevenc@xxxxxxxxxxxxx>
> >>    To: <wireshark-users@xxxxxxxxxxxxx>
> >>    Sent: Monday, September 24, 2007 5:57 PM
> >>    Subject: [Wireshark-users] HTTP Filter for 401 response
> >>
> >>
> >>      
> >>>    I have version 0.99.6a installed on WinXpSP2. The default 
> >>>    installation of
> >>>    wireshark does not display the HTTP 401 Authorization Required using 
> >>>    the
> >>>    HTTP filter; it is labeled TCP. Do I need to change a preference or 
> >>>    some
> >>>    other setting so that HTTP filter includes the 401?
> >>>    Thanks,
> >>>    Steve
> >>>
> >>>    _______________________________________________
> >>>    Wireshark-users mailing list
> >>>    Wireshark-users@xxxxxxxxxxxxx
> >>>    http://www.wireshark.org/mailman/listinfo/wireshark-users
> >>>
> >>>        
> >>
> >>
> >>    _______________________________________________
> >>    Wireshark-users mailing list
> >>    Wireshark-users@xxxxxxxxxxxxx
> >>    http://www.wireshark.org/mailman/listinfo/wireshark-users
> >>      
> >
> >    ------------------------------------------------------------------------
> >    _______________________________________________
> >    Wireshark-users mailing list
> >    Wireshark-users@xxxxxxxxxxxxx
> >    http://www.wireshark.org/mailman/listinfo/wireshark-users
> >
> >------------------------------------------------------------------------
> >
> >_______________________________________________
> >Wireshark-users mailing list
> >Wireshark-users@xxxxxxxxxxxxx
> >http://www.wireshark.org/mailman/listinfo/wireshark-users
> >  

> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-users