Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 9112] epan/follow.c - Incorrect "bytes missing in capture

Date: Tue, 29 Oct 2013 11:11:32 +0000

changed bug 9112

What Removed Added
Status UNCONFIRMED CONFIRMED
CC   [email protected]
Ever confirmed   1

Comment # 8 on bug 9112 from
Hi,
(In reply to comment #6)
> Thanks for formatting!
> 
> I think that this bug came to life after the gulong -> guint32 switch done
> in:
> r1=46402&r2=46748">http://anonsvn.wireshark.org/viewvc/trunk/epan/follow.
> c?r1=46402&r2=46748
> 

> About http://anonsvn.wireshark.org/viewvc?view=revision&revision=31334,
> I see here the meaning of changing the curly bracket's location, but yes
> dont understand the reason of the other line's glongcasting/subtraction
> instead of previous single '>' operator..
> Maybe Sake can answer?

I guess it's for sequence wrap around but casting with glong on 64 bits system
is wrong should be gint32 or better use macros LT_SEQ/GT_SEQ defined in
dissectors/packet-tcp.h,.

It works, sort of, without casting because most of the time wireshark is using
relative sequences and there's no wrap around (wireshark will grind to a halt
if you try to follow a > 4GB conversation :)).

> 
> What I know is that, after applying my patch, I've never seen again
> incorrect "bytes missing in capture file" msgs, and all data are ok
> [I use tshark/wireshark mainly for decoding http streams, and I've done by
> myself the dechunk/gunzip routines, since I've seen they were broken in
> wireshark].
> 
> If I'll have time, I'll anonymize some capture files that show the issue.


You are receiving this mail because:
  • You are watching all bug changes.