Wireshark-bugs: [Wireshark-bugs] [Bug 2157] SOCKS 5 decoding fails when client pipelines connect
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 15 Apr 2013 13:32:14 +0000

changed bug 2157

What Removed Added
CC   mmann78@netscape.net

Comment # 4 on bug 2157 from 
This issue appears to be that the SOCKS dissector doesn't support TCP
fragmentation (which would obviously be an enhancement, not a bugfix).  I took
the SOCKS dissector from the SVN and added "minimal" (somewhat "manual") TCP
defragmentation.  Attachment 1333 [details] still didn't decode successfully.

In looking at it more closely, I think the TCP SEQ/ACK counts are incorrect and
that is also the reason it's not successfully decoded.

I opened attachment 1333 [details] in v1.4.4 (the oldest version I had lying around) and
it (correctly?) identifies frame 4 as a SOCKS packet (using Decode As...). 
Opening up attachment 1333 [details] in v1.8.6 and SVN, frame 4 is not identified as a
SOCKS packet (with frame 6 being the first SOCKS frame).

Am I correct that the TCP SEQ/ACK counts are incorrect and that's why frame 4
isn't identified as a SOCKS packet?  Would tcp_dissect_pdus (i.e. proper TCP
defragmentation) help?  The SOCKS protocol doesn't lend itself well to
tcp_dissect_pdus, but I can give it a shot if someone thinks it would help.

You are receiving this mail because:
  • You are the assignee for the bug.
  • You are watching all bug changes.