This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

alt text

Currently, I've faced sme problem while uploading the file to ftp server. If I upload the file via ftp-put command, sometimes a few thousand bytes was changed from original file. But, it isn't happen always... just once in a month... anyway, I've captured the trace from all possible points as attached points and tried to filter out(Follow TCP Stream > RAW > Save As) AAA.jpg from each point then, compare these /w origin file.

It was simple job but unexpected problem was occurred. Thru the network, many packets changed its' order set. For example, packets transfered /w sequence number 1,2,3,4,5,6 but receiver get the packets 1,2,4,5,6,3.

The biggest problem is... 'Follow TCP Stream' just re-assemble the trace as it is... packet orderset by 1,2,4,5,6,3. So, it cannot be compared /w origin file. Is there any solution to sort the packets by sequence number?

Thanks. -Sunny

asked 31 Aug '11, 19:22

Sunny%20Hilliter's gravatar image

Sunny Hilliter
1223
accept rate: 0%

Getting back to your original problem: Are you sure you always transfer the file in binary mode?

(01 Sep '11, 08:17) Jaap ♦

Follow TCP Stream is supposed to reorder packets so that the stream is presented the same way as it is to the application. So in your case, all the RAW exports should be the same. If not, there might be any of these issues:

  • The TCP sequence numbers of the packets are messed up, messing up the reassembly done by "Follow TCP stream", but this will also mess up the reception of the file.

  • There is a bug in the "Follow TCP Stream" code in Wireshark, if you think this is the case, could you file a bug at https://bugs.wireshark.org/ and attach the tracefile that is exhibiting this behavior?

permanent link

answered 31 Aug '11, 23:58

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×82
×24

question asked: 31 Aug '11, 19:22

question was seen: 3,495 times

last updated: 01 Sep '11, 08:17

p​o​w​e​r​e​d by O​S​Q​A