Wireshark-dev: Re: [Wireshark-dev] strange packet dissection order when loading the 1st pcap fi
Le 25/06/2012 22:26, Stephen Fisher a écrit :
---- On Mon, 25 Jun 2012 14:08:22 -0600 wsgd wrote ----
Summary :
- packets are dissected twice (3 times for packet 1)
- in the good order for 1st sequence
- not in the good order for the 2nd sequence
packet 4 dissected just after packet 1
This happens on wireshark : 1.8.0, 1.6.0, 1.6.1, 1.6.2, 1.4.7
This does not happen :
- on wireshark 1.2.18
- when wireshark is started by double-clicking the pcap file
- when opening 2nd, 3rd ... pcap file
- if pcap file has less than 8 packets
The new behavior is probably because the new packet list became default starting with release 1.4 (and many SVN revisions before that).
ok
There are no guarantees of what order packets will be dissected in, although the first time through is usually (always?) sequential.
I hope it is always sequential the 1st time !
The new packet list focuses dissection on the currently displayed packets, so if you move the scroll bar (or even mouse cursor), it may need to re-dissect packets.
Yes.
But even I reduce the summary pane to less than 1 line, the 2nd sequence
is : 1 4 1.
4th packet still here !
And is this case, this still valid if I re-open the pcap file (not only
the 1st time).
Thanks for the info,
Olivier
___________________________________________________________________________
Sent via: Wireshark-dev mailing list<wireshark-dev@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
--
Wireshark Generic Dissector http://wsgd.free.fr
