Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 3467] Memcache Textual Protocol dissector patch

Date: Tue, 19 May 2009 11:47:01 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3467





--- Comment #12 from Rama Chitta <rama@xxxxxxxxx>  2009-05-19 11:47:01 PDT ---
> Please find my comments inline:
> 
> > In frame 6 and 15 in your example we get two tree items with "Memcache
> > Protocol", the latest with only \r\n, which I think is wrong because we only
> > have one command.  Are you able to fix this?
> 

After a little bit of investigation, I see that the \r\n come as a completely
different packet when they are a part of the the packet before. Somehow the
packet reassembly is not happening. Observe that the tvb s are different. 

The command should contain 33bytes  in a packet, but after packet reassembly
they come as 2 packets with 31 bytes in one packet and the other packet
contains 2 bytes (\r\n). So, we treat it as a different packet and display in
the same frame? I think I'll need to brush up on how the tvbs work to
understand this better.

new pkt: tvb: 0x1dccf8c0
offset: 31 , orig_offset: 0, diff: 31

new pkt: tvb: 0x1dccf700
offset: 2 , orig_offset: 0, diff: 2

I'll see if I could suppress packets like these.


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.