Wireshark-bugs: [Wireshark-bugs] [Bug 10770] new riemann protocol dissector doesn't work for TCP
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Fri, 12 Dec 2014 22:43:08 +0000

changed bug 10770


What Removed Added
Status UNCONFIRMED IN_PROGRESS
Ever confirmed   1

Comment # 7 on bug 10770 from 
According to the captures you provided, it seems like the first 4 bytes of the
TCP payload contains the Riemann packet size, which simplifies things greatly.
Unfortunately none of capture you provided have several Riemann packets in a
given TCP segment, or a Riemann packet over several TCP segments so I could not
verify that everything works fine.
The file riemann-tcp-events-batched.pcapng shows ethernet packets with 8356
bytes so presumably bigger than the MTU and the driver did some offloading. It
would be great if you could redo such a capture where we can see a Riemann
packet split across several TCP segments.

You are receiving this mail because:
  • You are watching all bug changes.