https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15017
Bug ID: 15017
Summary: Reassembly of HTTP with overlapping TCP segments gives
different streams for TCP and HTTP
Product: Wireshark
Version: 2.6.2
Hardware: x86
OS: OS X 10.9
Status: UNCONFIRMED
Severity: Major
Priority: Low
Component: Dissection engine (libwireshark)
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Created attachment 16516
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=16516&action=edit
TCP stream where HTTP and TCP follow stream are different
Build Information:
TShark (Wireshark) 2.6.2 (v2.6.2-0-g1b3cedbc)
Copyright 1998-2018 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with libpcap, without POSIX capabilities, with GLib 2.36.0,
with zlib 1.2.5, with SMI 0.4.8, with c-ares 1.12.0, with Lua 5.2.4, with
GnuTLS
3.4.17, with Gcrypt 1.7.7, with MIT Kerberos, with MaxMind DB resolver, with
nghttp2 1.21.0, with LZ4, with Snappy, with libxml2 2.9.4.
Running on Mac OS X 10.9.5, build 13F34 (Darwin 13.4.0), with Intel(R)
Core(TM) i7-3615QM CPU @ 2.30GHz (with SSE4.2), with 16384 MB of physical
memory, with locale en_US.UTF-8, with libpcap version 1.3.0 - Apple version 41,
with GnuTLS 3.4.17, with Gcrypt 1.7.7, with zlib 1.2.5, binary plugins
supported
(13 loaded).
Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build
2336.9.00).
--
In the attached PCAP an incomplete HTTP request is sent right after the 3-way
handshake in frame number 4 with TCP sequence number 2 and the data as "ET
/goodsite.html HTTP/1.1\r\nHost: scapy\r\n\r\n".
In frame number 6 another TCP packet is sent with TCP sequence number 1 and the
data is "GET /evilsite.html HTTP/1.1\r\nHost: scapy\r\n\r\n".
I'm not exactly sure what Wireshark should be interpreting for this but the
HTTP server I tested this against processed this as an HTTP GET for
/evilsite.html and responded accordingly.
What I'm noticing in Wireshark is that the TCP and HTTP Follow stream tools
both print something different.
Follow TCP shows this:
# tshark -q -r tcp_vs_http_reassembly.pcapng -z follow,tcp,ascii,0
===================================================================
Follow: tcp,ascii
Filter: tcp.stream eq 0
Node 0: 172.16.1.130:48330
Node 1: 172.16.1.117:80
44
GET /evilsite.html HTTP/1.1
Host: scapy
17
HTTP/1.0 200 OK
171
Server: SimpleHTTP/0.6 Python/2.7.5
Date: Thu, 19 Jul 2018 18:33:59 GMT
Content-type: text/html
Content-Length: 5
Last-Modified: Thu, 19 Jul 2018 17:50:05 GMT
EVIL
===================================================================
While following HTTP shows:
# tshark -q -r tcp_vs_http_reassembly.pcapng -z follow,http,ascii,0
===================================================================
Follow: http,ascii
Filter: tcp.stream eq 0
Node 0: 172.16.1.130:48330
Node 1: 172.16.1.117:80
0
43
ET /goodsite.html HTTP/1.1
Host: scapy
183
HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/2.7.5
Date: Thu, 19 Jul 2018 18:33:59 GMT
Content-type: text/html
Content-Length: 5
Last-Modified: Thu, 19 Jul 2018 17:50:05 GMT
5
EVIL
===================================================================
Should both of the follow stream tools print the same stream? If there is any
additional information I can get or anything else I can try let me know. I
wrote a script using scapy to send the HTTP request this way and I can share
this as well if it would help at all.
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <[email protected]>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:[email protected]?subject=unsubscribe
