Wireshark-bugs: [Wireshark-bugs] [Bug 10503] TCP sequence number rollover: Wireshark incorrectly
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 01 Dec 2014 20:46:10 +0000

changed bug 10503


What Removed Added
CC   maximalmin@gmail.com

Comment # 7 on bug 10503 from 
I recently encountered what I believe to be the related bug (might be same bug)
where the Sequence number did not roll over, however, the packet analysis
apparently kicked off some other dissector mid stream, and when the next packet
is dissected, it reports the New fragment overlaps old data issue (where as a
manual analysis shows no such issue)

Capture and Analysis both on v1.12.2 (v1.12.2-0-g898fa22 from master-1.12)

The stream has mostly the same data so it's highly compressible.
Packet number 42643 shows the packet using standard TCP dissector
  seq 5713245 (rel), len 268, next = 5713513   (abs seq = 00574756)
Packet number 42645 shows the packet using HiSLIP?? dissector, but tcp header:
  seq 5713513 (rel), len 268, next = 5713781
Packet number 42647 shows the packet back to standard TCP dissector
  seq 5713781 (rel), len 268, next = 5714049

Summary for packet shows the TCP: New fragment overlaps old data (retrans...)
text

Attaching the files as Wireshark-TCP-Sequence-Bug.7z
Screenshot in  Wireshark-TCP-Sequence-Bug.png

You are receiving this mail because:
  • You are watching all bug changes.