Wireshark-users: Re: [Wireshark-users] Missing TCP Flags
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Wed, 8 Sep 2010 14:46:47 -0600
On Wed, Sep 08, 2010 at 02:37:58PM +0100, Scheffenegger, Richard wrote:

> I have here a trace with the RFC3540 ECN Nounce. That (valid) TCP Flag 
> is one of the lower 4 bits where the TCP options length is also 
> stored; however, Wireshare doesn't seem to decode the full 12-bit TCP 
> Flags field properly - only the lower 8 bits are shown.
>
> Does anyone know how to fix this, so that the full 12 bit field is 
> decoded (3 reserved bits, ECN, CWR, ECE, URG, ACK, PSH, RST, SYN, FIN 
> )?

Thanks for bringing this up.  This caught my interest, so I committed a 
change to the source code to expand the flags coverage to the whole 12 
bits.  It's in SVN revision 34084 and will be in the next release with 
new features (not 1.4.x as those are only fixes).  In the mean time, you 
can download an automated build from 
http://www.wireshark.org/download/automated/ within a few hours (just 
look for a filename containing the number 34084 or higher).