Wireshark · Ethereal-dev: [Ethereal-dev] Bug in compressed sniffer file decode

["Greg Morris" <gmorris@xxxxxxxxxx>]

When attempting to decode a NAI Sniffer file CAZ. The initial dissection works. But if you filter down the trace and then reset the filter then the file is no longer dissected. The original trace included around 18000 packets. I stripped it down to as low as 250 packets and was able to duplicate the problem. If I get the file below 250 packets I can no longer get the problem to occur.

 

To duplicate just open the CAZ file

Select any item in the packet decode window and right click and match selected to create a simple filter.

Finally click reset. I have had it several times just mark all of the packets as TCP segments and at other times it displays all of the packets as srvloc.

 

Attached is the trace file.

Attachment: Snif6.caz
Description: Binary data