ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] Bug in compressed sniffer file decode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Greg Morris" <gmorris@xxxxxxxxxx>
Date: Wed, 03 Sep 2003 15:21:53 -0600
Also note that if you click the menu option File/Reload all is back to normal. Then just click the reset button on the main window and the problem reoccurs. The first time you click the reset button the column data still looks ok but on the second click the column data goes bad as well.
 
Of course this is only on caz files with 250 or more packets.
 
Greg

>>> Gilbert Ramirez <gram@xxxxxxxxxxxxxxx> 9/3/2003 3:15:52 PM >>>
On Wed, 2003-09-03 at 16:11, Gilbert Ramirez wrote:
> On Tue, 2003-09-02 at 18:03, Greg Morris wrote:
>
> > To duplicate just open the CAZ file
> > Select any item in the packet decode window and right click and match
> > selected to create a simple filter.
> > Finally click reset. I have had it several times just mark all of the
> > packets as TCP segments and at other times it displays all of the
> > packets as srvloc.
> > 
> > Attached is the trace file.
> > ----
> >
>
> FYI, regarding the 250-packet file, I opened the file, and then used the
> down arrow to visit each packet. The final protocol in the dissection
> (protocol tree) matched the information in the summary window. However,
> as soon as I clicked a previous packet, i.e., traveled backward in the
> file, the wrong data was loaded for that packet.
>
> --gilbert

Another data point. The problem occurs *only* if I visit the 250th
packet. If I scroll through any of the other first 249 packets, and
travel backward, everything is fine. But if I re-dissect the last
packet, then it goes crazy. Thus, the problem may not have anything to
do with "traveling backward", but rather, something being askew after
visiting the last packet.  (i.e., you can't avoid but "traveling
backward" after having visited the last packet).

--gilbert