This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I've noticed that if I take an LDAP packet capture, follow a long conversation, sort the list of packets by 'info' and scroll through the list of search results, the number of results at the top of the LDAPMessage decode just increments with every packet I look at. It's the number in the square brackets, like [570 results] or whatever. That number then carries into the next SearchResultDone packet that I look at but if I look at another SearchResultDone packet after that, the number resets to [0 results]. I don't even think that there is a result count in the SearchResultDone LDAPMessage; there doesn't seem to be a field for it.

I'd recommend changing the LDAP decoder to no longer display a number of results at all for SearchResultDone LDAPMessages and to properly count the number of results in the specific SearchResultEntry LDAPMessage instead of just incrementing the count from the last packet.

asked 16 Feb '16, 09:51

Tony%20Hammitt's gravatar image

Tony Hammitt
6112
accept rate: 0%


That would be an enhancement request that should be filed via Bugzilla.

permanent link

answered 16 Feb '16, 12:17

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×24
×9

question asked: 16 Feb '16, 09:51

question was seen: 961 times

last updated: 16 Feb '16, 12:17

p​o​w​e​r​e​d by O​S​Q​A