It appears that Wireshark 2.4.2 is now displaying "S+" in the Info field instead of "S+*" on Syn packets leaving the server side Steelhead towards the server. I believe older versions of Wireshark used "S+" for Syn packets from the client side Steelhead, while using "S+*" for Syn packets forwarded from other Steelheads (e.g. the server side Steelhead or other mid-stream Steelheads.
Is that intentional or an oversight?
asked 27 Oct '17, 17:09
edited 28 Oct '17, 00:44
Yes, you're right. Up to version 2.2.X these packets where flagged with S+*. With the latest stable version and developer master this is missing. Furthermore my tests captures are interpreted as malformed after the "Riverbed Probe Option" with 2.4.X
So this is a bug.
I will open a bug and check if I can fix it.
answered 29 Oct '17, 04:01