https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14965

            Bug ID: 14965
           Summary: Follow stream output reversed
           Product: Wireshark
           Version: Git
          Hardware: x86
                OS: OS X 10.9
            Status: UNCONFIRMED
          Severity: Major
          Priority: Low
         Component: TShark
          Assignee: bugzilla-ad...@wireshark.org
          Reporter: t...@qacafe.com
  Target Milestone: ---

Created attachment 16486
  --> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=16486&action=edit
DNS Lookup

Build Information:
TShark (Wireshark) 2.6.2rc0-158-gbe503716 (v2.6.2rc0-158-gbe503716)

Copyright 1998-2018 Gerald Combs <ger...@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, without POSIX capabilities, with GLib 2.36.0,
with zlib 1.2.5, with SMI 0.4.8, with c-ares 1.12.0, with Lua 5.2.4, with
GnuTLS
3.4.17, with Gcrypt 1.7.7, with MIT Kerberos, with MaxMind DB resolver, with
nghttp2 1.21.0, with LZ4, with Snappy, with libxml2 2.9.4.

Running on Mac OS X 10.9.5, build 13F34 (Darwin 13.4.0), with       Intel(R)
Core(TM) i7-3615QM CPU @ 2.30GHz (with SSE4.2), with 16384 MB of physical
memory, with locale en_US.UTF-8, with libpcap version 1.3.0 - Apple version 41,
with GnuTLS 3.4.17, with Gcrypt 1.7.7, with zlib 1.2.5, binary plugins
supported
(13 loaded).

Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build
2336.9.00).
--
It looks like the follow stream output in tshark has flipped with the latest
automated build. On OSX I downloaded version 2.6.2rc0-158-gbe503716. When
printing out the UDP stream for a DNS lookup the answer is shown before the
query

# tshark -q -z follow,udp,hex,0 -Y 'udp.stream eq 0' -c 5000 -r
~/dns_lookup.pcapng

===================================================================
Follow: udp,hex
Filter: udp.stream eq 0
Node 0: 172.16.1.174:59365
Node 1: 172.16.1.5:53
        00000000  63 54 81 80 00 01 00 0b  00 04 00 00 06 67 6f 6f  cT......
.....goo
        00000010  67 6c 65 03 63 6f 6d 00  00 01 00 01 c0 0c 00 01  gle.com.
........
        00000020  00 01 00 00 00 29 00 04  4a 7d e2 41 c0 0c 00 01  .....)..
J}.A....
        00000030  00 01 00 00 00 29 00 04  4a 7d e2 42 c0 0c 00 01  .....)..
J}.B....
        00000040  00 01 00 00 00 29 00 04  4a 7d e2 43 c0 0c 00 01  .....)..
J}.C....
        00000050  00 01 00 00 00 29 00 04  4a 7d e2 44 c0 0c 00 01  .....)..
J}.D....
        00000060  00 01 00 00 00 29 00 04  4a 7d e2 45 c0 0c 00 01  .....)..
J}.E....
        00000070  00 01 00 00 00 29 00 04  4a 7d e2 46 c0 0c 00 01  .....)..
J}.F....
        00000080  00 01 00 00 00 29 00 04  4a 7d e2 47 c0 0c 00 01  .....)..
J}.G....
        00000090  00 01 00 00 00 29 00 04  4a 7d e2 48 c0 0c 00 01  .....)..
J}.H....
        000000A0  00 01 00 00 00 29 00 04  4a 7d e2 49 c0 0c 00 01  .....)..
J}.I....
        000000B0  00 01 00 00 00 29 00 04  4a 7d e2 4e c0 0c 00 01  .....)..
J}.N....
        000000C0  00 01 00 00 00 29 00 04  4a 7d e2 40 c0 0c 00 02  .....)..
J}.@....
        000000D0  00 01 00 02 9e ad 00 06  03 6e 73 34 c0 0c c0 0c  ........
.ns4....
        000000E0  00 02 00 01 00 02 9e ad  00 06 03 6e 73 32 c0 0c  ........
...ns2..
        000000F0  c0 0c 00 02 00 01 00 02  9e ad 00 06 03 6e 73 31  ........
.....ns1
        00000100  c0 0c c0 0c 00 02 00 01  00 02 9e ad 00 06 03 6e  ........
.......n
        00000110  73 33 c0 0c                                       s3..
00000000  63 54 01 00 00 01 00 00  00 00 00 00 06 67 6f 6f  cT...... .....goo
00000010  67 6c 65 03 63 6f 6d 00  00 01 00 01              gle.com. ....
===================================================================

In version 2.6.1 this output is reversed. It also looks like this is happening
for following TCP streams as well.

-- 
You are receiving this mail because:
You are watching all bug changes.
___________________________________________________________________________
Sent via:    Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives:    https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
             mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

Reply via email to