Hi,
The return message comes from a different IP addresss then where the
request was send to. This way it doesn't match the conversation setup
by the first packet.
Thanx,
Jaap
Sent from my iPhone
On 8 dec 2008, at 11:06, "Lars Ruoff" <lars.ruoff@xxxxxxxxxxxxxxxxx>
wrote:
Hi List,
Please could someone check if you experience the same issue:
In the attached files, consisting of two packets each, a TFTP Read
Request
and a TFTP Option acknowledgement, i get the Option acknowledgment
decoded
only for the first file.
For the second file, TFTP is not decoded automatically for the second
packet.
If i manually DECODE AS... TFTP, it shows up fine.
I wonder why this is?
It happens that the first file (decoded) corresponds to a real life
working
scenario, while the second corresponds to a real life NON-working
scenario.
So i wonder if the fact theat Wiresharks decodes in one place but
not the
other might be a real problem of the packet.
I can turn it round and round, but i don't see any noticeable
difference
(other than different option values) between the two scenarios.
Your help would be much appreciated.
Lars
<TFTP-decoded.pcap>
<TFTP-not-decoded.pcap>
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users
