Wireshark-users: Re: [Wireshark-users] reassemble.c assertion tvb_bytes_exist in 1GB trace file
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Tue, 16 Nov 2010 10:52:22 -0700
On Mon, Nov 08, 2010 at 11:28:18AM -0700, Stephen Fisher wrote:
> On Sat, Nov 06, 2010 at 01:57:03PM -0000, Scheffenegger, Richard wrote:
> 
> > ** (tshark.exe:1920): WARNING **: Dissector bug, protocol TCP, in 
> > packet 84634: reassemble.c:929: failed assertion "tvb_bytes_exist(tvb, 
> > offset, frag_data_len)"
> 
> That is a bug in Wireshark.  Please re-send the packet capture (just 
> one or two packets which are causing the problem), since this time it 
> came through as a WINMAIL.DAT file to us non-Microsoft e-mail users.

Thanks for sending the capture file to me.  The problem is that 
Wireshark is trying to reassemble the TCP segments into a whole stream 
so that it can dissect it, but since each packet was limited to a max of 
200 bytes captured, this isn't working.  I'm going to move this 
discussion over to the wireshark-dev mailing list for discussion because 
I don't think reassembly should be done when the capture size is 
limited.