Wireshark-bugs: [Wireshark-bugs] [Bug 4714] dns dissector on UDP packets influences tcp.stream
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 27 Apr 2010 01:32:40 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4714

--- Comment #2 from alantu@xxxxxxxx 2010-04-27 01:32:38 PDT ---
(In reply to comment #1)
> The number assigned to the TCP stream has a file(-set) scope and is based on
> the conversations identified in the file. Conversations are a generic mechanism
> to track exchanges between two identifiable endpoints. This happens on many
> protocol layers. Therefore no significance can be drawn from the value other
> then a correlation between equal numbered frames.
> In this case the DNS exchange also constitutes a conversation.

So this is a feature? I would submit that non-TCP packets should not have a
baring on the tcp.stream field. tcp.stream should count TCP conversations only.
tcp.stream should be a layer 4 field and not be influenced by application-layer
dissectors. Or, the field should be named something like meta.conversation.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.