This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Follow tcp stream showing incorrect HTTP payload

0

I have a single TCP flow in a pcap. "Follow --> TCP Stream" seems to be showing the wrong HTTP payload in Wireshark 2.2.1 (Win7-64 SP1). (But all 23 packets seem to be shown correctly; it's just the payload decode that seems to be incorrect.)
alt text alt text

Is this a known bug? I searched but didn't find an existing defect. Anyone else observed something similar?

Note, "Follow --> TCP Stream" does seem to work correctly in Wireshark 2.0.1 (Mac OSX 10.11.6). alt text

asked 17 Oct '16, 09:17

wwwalker's gravatar image

wwwalker
21●2●2●6
accept rate: 0%

edited 17 Oct '16, 09:23

One Answer:

2

Looks like you're running into bug 12855.

answered 17 Oct '16, 12:30

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k●5●72
accept rate: 27%