http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2378
--- Comment #5 from Ramin <ramin@xxxxxxxxx> 2008-04-05 00:45:47 GMT ---
(In reply to comment #4)
> The conversations that do not show the scaled tcp windows are passive ftp-data
> sessions. It looks like a wildcars conversation is created and is indeed used
> to bind the new tcp session to the ftp-data dissector. Unfortunately it looks
> like the tcp conversation data is not initialised, resulting in absolute
> sequence numbers and no scaled windows.
>
> I will have a look into it...
>
Please note that if you filter only the ftp stream, save the pacap and open it
again, the window scaling is show correct. As Chris pointed out in Comment #3
above, I think something before the 3-way handshake (or perhaps right after it)
is throwing Wireshark off.
BTW, wireshark is most definitely an amazing piece of software. Thank you all.
--
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
