Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 12565] New: HTTP count on Protocol Hierarchy off by one

Date: Tue, 28 Jun 2016 23:24:31 +0000
Bug ID 12565
Summary HTTP count on Protocol Hierarchy off by one
Product Wireshark
Version 2.0.4
Hardware x86
OS Windows 7
Status UNCONFIRMED
Severity Normal
Priority Low
Component Dissection engine (libwireshark)
Assignee [email protected]
Reporter [email protected]

Created attachment 14688 [details]
Capture file showing Protocol Hierarchy HTTP count off by one

Build Information:
Version 2.0.4 (v2.0.4-0-gdd7746e from master-2.0)

Copyright 1998-2016 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.3.2, with WinPcap (4_1_3), with libz 1.2.8, with
GLib 2.42.0, with SMI 0.4.8, with c-ares 1.11.0, with Lua 5.2, with GnuTLS
3.2.15, with Gcrypt 1.6.2, with MIT Kerberos, with GeoIP, with QtMultimedia,
with AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with locale C, with
WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version
1.0 branch 1_0_rel0b (20091008), with GnuTLS 3.2.15, with Gcrypt 1.6.2, with
AirPcap 4.1.1 build 1838.
Intel(R) Core(TM) i7 CPU       Q 840  @ 1.87GHz (with SSE4.2), with 8177MB of
physical memory.


Built using Microsoft Visual C++ 12.0 build 40629
--
In the attached trace file, a display filter of "http" shows 5,261 packets.
This appears to be the correct count, since it matches "tcp.port==80 && tcp.len
> 0".

The Protocol Hierarchy is off by one, and shows a count for "Hypertext Transfer
Protocol" of 5,262.

These counts are the same regardless of whether the TCP preference "Do not call
subdissectors for error packets" is ON or OFF.


You are receiving this mail because:
  • You are watching all bug changes.