Wireshark-users: [Wireshark-users] tcpdump with snaplen set to 128
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Perry Smith <pedzsan@xxxxxxxxx>
Date: Mon, 15 Oct 2012 14:54:42 -0500
Hi,

With a fairly simple ftp trace where we capture only the first 128 bytes of data, wireshark displays that it did not see the previous segment.  The IP header says that it is a 1500 byte packet.  Wireshark is using the capture lengh of 128 instead of the real packet length.  e.g. the next sequence is the current sequence plus the captured length, not the IP packet length.

It also confused the ack processing and says that the packet a particular ack is acking was never seen when in fact it was.

Is this a bug?  Or am I confused?

Thank you,
Perry Smith