Comment # 2
on bug 9882
from [email protected]
The reason that "Reassembled TCP (411 bytes)" in the bottom pane is incorrect
is that there is a 1 byte overlap at relative sequence number 5. It looks like
this:
Segment 1 (packet 3):
0 = SYN
1 = 'G'
2 = 'E'
3 = 'T'
4 = ' '
5 = '/'
Segment 2 (packet 6):
5 = 't'
6 = 'e'
7 = 's'
8 = 't'
...
So it seems that in the bottom pane the segment data is simply concatenated.
It should instead resolve the overlap resulting in either:
"GET /est..."
or
"GET test..."
as an actual TCP implementation would. The fist case makes the most sense
since that is the same as the follow stream content.
Also note that the info field in the top pane is consistent with the bottom and
should be fixed as well.
For reference, consider the overlap-2.pcap which differs only in that the
payload first appears after the SYN. For this pcap, everything looks good and
is consistent with the follow stream content for the original pcap.
You are receiving this mail because:
- You are watching all bug changes.
