Wireshark-bugs: [Wireshark-bugs] [Bug 10335] 1.12.0 does not dissect HTTP correctly
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 25 Apr 2016 22:01:13 +0000

Comment # 12 on bug 10335 from 
Created attachment 14511 [details]
Capture file showing HTTP packets not correctly identified by Wireshark

The attached trace file has 9,000 http packets and shows the problem very
clearly. The display filter "tcp.port==80 and tcp.len > 0" shows 6,229 packets,
which is what should match the "http" display filter. With the TCP preference
"Allow subdissector to reassemble TCP streams" off, Wireshark v2.0.3 shows only
31 packets matching "http". Same for version 1.12.11. Version 1.10.14 shows
6,229 packets matching the "http" filter, which is what all versions should
show.

In other words, starting with v1.12.0, all versions of Wireshark through and
including 2.0.3 correctly identify only 0.5% of the HTTP packets in this trace.

All versions show one packet matching the filter when "Allow subdissector to
reassemble TCP streams is on."

You are receiving this mail because:
  • You are watching all bug changes.