Wireshark-bugs: [Wireshark-bugs] [Bug 4714] dns dissector on UDP packets influences tcp.stream
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 27 Apr 2010 01:52:01 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4714

--- Comment #3 from alantu@xxxxxxxx 2010-04-27 01:51:58 PDT ---
(In reply to comment #1)
> The number assigned to the TCP stream has a file(-set) scope and is based on
> the conversations identified in the file. Conversations are a generic mechanism
> to track exchanges between two identifiable endpoints. This happens on many
> protocol layers. Therefore no significance can be drawn from the value other
> then a correlation between equal numbered frames.
> In this case the DNS exchange also constitutes a conversation.

Also, disabling the http dissector does not have an effect on the tcp.stream
numbers as disabling the dns dissector does. My fundamental comment is that
application layer decoding or dissecting (or lack thereof) should not impact
this tcp.stream field. tcp.stream should be consistent no matter what
application dissectors are active.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.