Wireshark · Ethereal-users: Re: [Ethereal-users] Ethereal problem

[Guy Harris <gharris@xxxxxxxxx>]

Daron.Johnson@xxxxxxxxxxxx wrote:

> I have ran in to a strange problem between two versions of Ethereal. The 
> two versions I am using are .10.4 and .10.7. When using the Follow TCP 
> Stream option and then Save As, version .10.4 saves the data correctly 
> however when using version .10.7 control characters are not saved 
> properly. For example a hex 02 <STX> is getting saved as a hex E3 
> (period character).

Hex E3 isn't an ASCII period; I assume you meant "hex 2E", which appears 
to be what's in the second file you sent.

Recent versions of Ethereal display non-printable characters as "." in 
the "Follow TCP Stream" window; older versions appear not to have done 
that.  This was probably a side-effect of fixing the code that *prints* 
the TCP stream data to show non-printable characters as ".".

It might be useful to have both "save as is" and "save as displayed" 
operations.