This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Riverbed Probe Decode - S+* Missing

0

It appears that Wireshark 2.4.2 is now displaying "S+" in the Info field instead of "S+*" on Syn packets leaving the server side Steelhead towards the server. I believe older versions of Wireshark used "S+" for Syn packets from the client side Steelhead, while using "S+*" for Syn packets forwarded from other Steelheads (e.g. the server side Steelhead or other mid-stream Steelheads.

Is that intentional or an oversight?

asked 27 Oct '17, 17:09

Rick16's gravatar image

Rick16
11112
accept rate: 0%

edited 28 Oct '17, 00:44

sindy's gravatar image

sindy
6.0k4851


One Answer:

0

Yes, you're right. Up to version 2.2.X these packets where flagged with S+*. With the latest stable version and developer master this is missing. Furthermore my tests captures are interpreted as malformed after the "Riverbed Probe Option" with 2.4.X

So this is a bug.

I will open a bug and check if I can fix it.

answered 29 Oct '17, 04:01

Uli's gravatar image

Uli
9031515
accept rate: 29%

Reported with bug 14150

(29 Oct '17, 04:14) Uli