ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 12855] Follow TCP Stream shows duplicate stream data

Date: Sat, 17 Sep 2016 14:24:13 +0000

Comment # 5 on bug 12855 from
Created attachment 14928 [details]
crafted packet with retransmitted and out-of-order packets (http)

Another minimal case with HTTP (because that one sets the expected reassembled
size). Created using a modified version of the previous script:
https://git.lekensteyn.nl/peter/wireshark-notes/tree/crafted-pkt/make-tcp.py?id=5a17d2a0a3aa6d7a672bd7cb4bf1362f2ede81e9

tshark 2.0.5:
===================================================================
Follow: tcp,hex
Filter: tcp.stream eq 0
Node 0: 10.0.0.1:32323
Node 1: 10.0.0.2:80
00000000  50 55 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  PUT / HT TP/1.1..
00000010  43 6f 6e 74 65 6e 74 2d  4c 65 6e 67 74 68 3a 20  Content- Length:
00000020  36 0d 0a                                          6..
00000023  0d 0a                                             ..
00000025  31 0a                                             1.
00000027  32 0a                                             2.
00000029  33 0a                                             3.
===================================================================

tshark master:
===================================================================
Follow: tcp,hex
Filter: tcp.stream eq 0
Node 0: 10.0.0.1:32323
Node 1: 10.0.0.2:80
00000010  50 55 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  PUT / HT TP/1.1..
00000020  50 55 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  PUT / HT TP/1.1..
00000030  50 55 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  PUT / HT TP/1.1..
00000040  43 6f 6e 74 65 6e 74 2d  4c 65 6e 67 74 68 3a 20  Content- Length:
00000050  36 0d 0a                                          6..
00000053  43 6f 6e 74 65 6e 74 2d  4c 65 6e 67 74 68 3a 20  Content- Length:
00000063  36 0d 0a                                          6..
00000066  50 55 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  PUT / HT TP/1.1..
00000076  43 6f 6e 74 65 6e 74 2d  4c 65 6e 67 74 68 3a 20  Content- Length:
00000086  36 0d 0a 0d 0a                                    6....
0000008B  0d 0a                                             ..
0000008D  32 0a                                             2.
0000008F  33 0a                                             3.
===================================================================


You are receiving this mail because:
  • You are watching all bug changes.