Wireshark mailing list archives

strange packet dissection order when loading the 1st pcap file


From: wsgd <wsgd () free fr>
Date: Mon, 25 Jun 2012 22:08:22 +0200

Hello all,


For your intelligency and for comments.


The following tests shows the packet dissection order during the load of a pcap file.
The result is put on 2 lines for readibility.


Load a pcap file just after wireshark opening.

* pcap file with 8 packets
1 2 3 4   5 6 7 8
1 4 1 2 3 5 6 7 8

* pcap file with 10 packets
1 2 3 4   5 6 7 8 9 10
1 4 1 2 3 5 6 7 8 9 10

* pcap file with 15 packets
1 2 3 4   5 6 7 8 9 10 11 12 13 14 15
1 4 1 2 3 5 6 7 8 9 10 11 12 13 14 15

Summary :
- packets are dissected twice (3 times for packet 1)
- in the good order for 1st sequence
- not in the good order for the 2nd sequence
  packet 4 dissected just after packet 1


This happens on wireshark : 1.8.0, 1.6.0, 1.6.1, 1.6.2, 1.4.7

This does not happen :
- on wireshark 1.2.18
- when wireshark is started by double-clicking the pcap file
- when opening 2nd, 3rd ... pcap file
- if pcap file has less than 8 packets



I do not know if it is an invalid order, a problem.
But it's strange !



Olivier

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request () wireshark org?subject=unsubscribe


Current thread: