This is our old Q&A Site. Please post any new questions and answers at

It appears that Wireshark 2.4.2 is now displaying "S+" in the Info field instead of "S+*" on Syn packets leaving the server side Steelhead towards the server. I believe older versions of Wireshark used "S+" for Syn packets from the client side Steelhead, while using "S+*" for Syn packets forwarded from other Steelheads (e.g. the server side Steelhead or other mid-stream Steelheads.

Is that intentional or an oversight?

asked 27 Oct '17, 17:09

Rick16's gravatar image

accept rate: 0%

edited 28 Oct '17, 00:44

sindy's gravatar image


Yes, you're right. Up to version 2.2.X these packets where flagged with S+*. With the latest stable version and developer master this is missing. Furthermore my tests captures are interpreted as malformed after the "Riverbed Probe Option" with 2.4.X

So this is a bug.

I will open a bug and check if I can fix it.

permanent link

answered 29 Oct '17, 04:01

Uli's gravatar image

accept rate: 29%

Reported with bug 14150

(29 Oct '17, 04:14) Uli
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 27 Oct '17, 17:09

question was seen: 2,219 times

last updated: 29 Oct '17, 04:14

p​o​w​e​r​e​d by O​S​Q​A