Hi,
2011/3/8 Philipp Marek <[email protected]>:
> On Tuesday 08 March 2011, Ph. Marek wrote:
>> When using a limited capture length "Follow TCP stream" shows no
>> indicator that there's data missing.
>> Not even the "Save to File" in hexdump gives holes in the addresses.
>>
>> I'd expect some visually marked hint "<data missing>" or something like
>> that, in both packet loss and truncated captures.
> Correction: It *does* show truncations (at least sometimes - I've surely had
> data missing and didn't see the indicator).
Could you please attach the problematic capture file?
When working with truncated packets one has to be prepared for such problems.
Every truncated packet is marked in tree-view:
...
Destination port: db-lsp-disc (17500)
Length: 147
Checksum: 0xd861 [unchecked, not all data available]
[Good Checksum: False]
[Bad Checksum: False]
Dropbox LAN sync Discovery Protocol
[Packet size limited during capture: DB-LSP-DISC truncated]
Display filter "short" will match those packets.
>
>
>
>> The hexdump should at least show correct addresses for the data - holes
>> in the dump would be unavoidable anyway.
> The indicator in the hexdump is a string like this:
>
> [2169 bytes missing in capture file]
>
> This has neither the correct length (even more so if only a few bytes are
> missing!!), and the addresses are still wrong.
>
> The "Flow Graph" shows no missing data, though??
>
>
>
>> Another, smaller nuisance are the empty lines in hexdump output.
> This is still true.
Reported to upstream as:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1678
Cheers,
Balint
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
