Wireshark-users: [Wireshark-users] TFTP Opt.Ack. not automatically decoded in one instance

From: "Lars Ruoff" <lars.ruoff@xxxxxxxxxxxxxxxxx>
Date: Mon, 8 Dec 2008 11:06:33 +0100

Hi List,

Please could someone check if you experience the same issue:

In the attached files, consisting of two packets each, a TFTP Read Request
and a TFTP Option acknowledgement, i get the Option acknowledgment decoded
only for the first file.
For the second file, TFTP is not decoded automatically for the second
packet.
If i manually DECODE AS... TFTP, it shows up fine.
I wonder why this is?
It happens that the first file (decoded) corresponds to a real life working
scenario, while the second corresponds to a real life NON-working scenario.
So i wonder if the fact theat Wiresharks decodes in one place but not the
other might be a real problem of the packet.
I can turn it round and round, but i don't see any noticeable difference
(other than different option values) between the two scenarios.

Your help would be much appreciated.
Lars

Attachment: TFTP-decoded.pcap
Description: Binary data

Attachment: TFTP-not-decoded.pcap
Description: Binary data