This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

LDAP search result count inaccuracy

0

I've noticed that if I take an LDAP packet capture, follow a long conversation, sort the list of packets by 'info' and scroll through the list of search results, the number of results at the top of the LDAPMessage decode just increments with every packet I look at. It's the number in the square brackets, like [570 results] or whatever. That number then carries into the next SearchResultDone packet that I look at but if I look at another SearchResultDone packet after that, the number resets to [0 results]. I don't even think that there is a result count in the SearchResultDone LDAPMessage; there doesn't seem to be a field for it.

I'd recommend changing the LDAP decoder to no longer display a number of results at all for SearchResultDone LDAPMessages and to properly count the number of results in the specific SearchResultEntry LDAPMessage instead of just incrementing the count from the last packet.

asked 16 Feb '16, 09:51

Tony%20Hammitt's gravatar image

Tony Hammitt
6112
accept rate: 0%


One Answer:

0

That would be an enhancement request that should be filed via Bugzilla.

answered 16 Feb '16, 12:17

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%