Re: [Wireshark-dev] Further HTTP woes...

2006-09-12 Thread ronnie sahlberg
running on a small microprocessor? ;-) > > > > Seriously, this behavior is coming out of Tomcat Web > > Server/3.3.1 Final > > (JSP 1.1; Servlet 2.2). We do, however, have our own implementations > > in which nagle is not available. I would have to check with the > &g

Re: [Wireshark-dev] Further HTTP woes...

2006-09-10 Thread Bryant Eastham
ehalf Of ronnie > sahlberg > Sent: Thursday, September 07, 2006 5:47 PM > To: Developer support list for Wireshark > Subject: Re: [Wireshark-dev] Further HTTP woes... > > > :-) > > > I have example captures of some x509 related protocols running atop > http which sho

Re: [Wireshark-dev] Further HTTP woes...

2006-09-10 Thread ronnie sahlberg
006 5:47 PM > To: Developer support list for Wireshark > Subject: Re: [Wireshark-dev] Further HTTP woes... > > > :-) > > > I have example captures of some x509 related protocols running atop http > which show this. > > I will try to look into implementing this in the

Re: [Wireshark-dev] Further HTTP woes...

2006-09-07 Thread ronnie sahlberg
in, Bryant From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of ronnie sahlbergSent: Thursday, September 07, 2006 5:47 PM To: Developer support list for WiresharkSubject: Re: [Wireshark-dev] Further HTTP woes... :-)I have example captures of some x509 related protocols running a

Re: [Wireshark-dev] Further HTTP woes...

2006-09-07 Thread Bryant Eastham
TED] [mailto:[EMAIL PROTECTED] On Behalf Of ronnie sahlbergSent: Thursday, September 07, 2006 5:47 PMTo: Developer support list for WiresharkSubject: Re: [Wireshark-dev] Further HTTP woes... :-)I have example captures of some x509 related protocols running atop http which show this.I w

Re: [Wireshark-dev] Further HTTP woes...

2006-09-07 Thread ronnie sahlberg
ything - I doubt it.Thanks,Bryant From: [EMAIL PROTECTED][mailto:[EMAIL PROTECTED] ] On Behalf Of ronniesahlbergSent: Thursday, September 07, 2006 5:32 PMTo: Developer support list for WiresharkSubject: Re: [Wireshark-dev] Further HTTP woes..."I now have the follow

Re: [Wireshark-dev] Further HTTP woes...

2006-09-07 Thread ronnie sahlberg
That would solve the problem for YOU   but would be the wrong way to solve the issue.We dont want dissectors to start implementing what is essentially tcp reassembly and tcp session tracking in the dissectors themself since this belongs in the tcp dissector   not in the application dissector. While

Re: [Wireshark-dev] Further HTTP woes...

2006-09-07 Thread Bryant Eastham
list for Wireshark Subject: Re: [Wireshark-dev] Further HTTP woes... "I now have the following problem. It is common for our implementation to dump the headers in one segment and then dump the data in the next, with no Content-Length." Why does it send this as two segments? You have no

Re: [Wireshark-dev] Further HTTP woes...

2006-09-07 Thread Bryant Eastham
-dev] Further HTTP woes... This only affects PDUs that spans multiple tcp segments.This can not be solved in the HTTP dissector but requires that the TCP dissector and the TCP reassembly code is enhanced to provide an api such as "reassemble tcp data from this segment and all the way until

Re: [Wireshark-dev] Further HTTP woes...

2006-09-07 Thread ronnie sahlberg
"I now have the following problem. It is common for our implementation todump the headers in one segment and then dump the data in the next, withno Content-Length."Why does it send this as two segments? You have not disabled NAGLE have you?  ___ Wireshar

Re: [Wireshark-dev] Further HTTP woes...

2006-09-07 Thread ronnie sahlberg
This only affects PDUs that spans multiple tcp segments.This can not be solved in the HTTP dissector but requires that the TCP dissector and the TCP reassembly code is enhanced to provide an api such as "reassemble tcp data from this segment and all the way until a RST or a FIN" TCP reassembly does

[Wireshark-dev] Further HTTP woes...

2006-09-07 Thread Bryant Eastham
It appears that HTTP requests/responses that are not chunked and do not include a Content-Length cannot be decoded correctly. The following comment appears in the code: * If no content length was supplied (or if a bad content length * was supplied), the amount of data to be proce