It appears that Wireshark 2.4.2 is now displaying "S+" in the Info field instead of "S+*" on Syn packets leaving the server side Steelhead towards the server. I believe older versions of Wireshark used "S+" for Syn packets from the client side Steelhead, while using "S+*" for Syn packets forwarded from other Steelheads (e.g. the server side Steelhead or other mid-stream Steelheads. Is that intentional or an oversight? asked 27 Oct '17, 17:09  Rick16 edited 28 Oct '17, 00:44  sindy |
One Answer:
Yes, you're right. Up to version 2.2.X these packets where flagged with S+*. With the latest stable version and developer master this is missing. Furthermore my tests captures are interpreted as malformed after the "Riverbed Probe Option" with 2.4.X So this is a bug. I will open a bug and check if I can fix it. answered 29 Oct '17, 04:01  Uli |
Reported with bug 14150