Wireshark · Ethereal-users: [Ethereal-users] Bug in "Follow TCP Stream"?

[William Pietri <william@xxxxxxxxxxx>]

I've come across what appears to be a bug in the "Follow TCP Stream"
command.

The situation is capturing some HTTP content over two non-privileged
ports via the loopback interface. (It's part of the internal workings of
a Java HTTP test framework called HttpUnit.) Although the packets are
captured correctly, only the first 16383 bytes of the document content
appear in the reassembled TCP stream.

I'm using a dual-processor Intel box running RedHat 8,0 (kernel
2.4.18-14smp). The copy of Ethereal is the RedHat-built
ethereal-0.9.11-1.80.0.

Is this a known problem? (I couldn't find anything obvious in the
mailing lists.) If it isn't, I've got sample capture and saved stream
files that I'd be glad to send to whomever's interested. I'm also glad
to experiment as needed.

Thanks,

William


----
brains for sale: http://scissor.com/