Hi,

Should we change the letter used for indicating the Congestion window reduced 
(CWR) flag from ‘C’ to ‘W’, in order to match the output of tcpdump (according 
to [1]) ? 
Or does this break something unforseen?

@@ -1088,11 +1088,11 @@ static char *
 tcp_flags_to_str_first_letter(wmem_allocator_t *scope, const struct tcpheader 
*tcph)
 {
     wmem_strbuf_t *buf = wmem_strbuf_new(scope, "");
     unsigned i;
     const unsigned flags_count = 12;
-    static const char first_letters[] = "RRRACEUAPRSF";
+    static const char first_letters[] = "RRRAWEUAPRSF";
     static const char digits[] = "01234567";
 
     /* upper three bytes are marked as reserved ('R'). */
     for (i = 0; i < flags_count; i++) {
         if (tcph->th_use_ace && 3 <= i && i <= 5) {

[1] 
https://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_segment_structure

PS: I know Ack is an ‘A’, rather than a ‘.’ as in tcpdump, but I guess that 
does not stand out enough between the ‘dot’ characters in the TCP flags string.

Thanks,
Jaap

_______________________________________________
Wireshark-dev mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to