tcpflow icon indicating copy to clipboard operation
tcpflow copied to clipboard

Published 20 hours ago • verified publisher icon simsong

incorrectly reassembling tcp stream

Open ibeex opened this issue 10 years ago • 4 comments

I haw TCP stream with lots off retransmits and when I try to extract specific flow that flow is corrupted. (it is JPG so I can see) When I select tat same flow in Wireshark and do follow tcp stream save raw, stream is OK (JPG). I can provide stream via email.

ibeex avatar Feb 06 '14 15:02 ibeex

Please send to [email protected]

Sent from my phone. Please Call me at 202-322-8411 if you wish a longer response.

On Feb 6, 2014, at 10:40 AM, ibeex [email protected] wrote:

I haw TCP stream with lots off retransmits and when I try to extract specific flow that flow is corrupted. (it is JPG so I can see) When I select tat same flow in Wireshark and do follow tcp stream save raw, stream is OK (JPG). I can provide stream via email.

— Reply to this email directly or view it on GitHub.

simsong avatar Feb 06 '14 17:02 simsong

It seems that PCAP contains double captured data, so basicly tcpflow is working OK.

ibeex avatar Feb 24 '14 10:02 ibeex

It should do a better job in this situation. May I add the PCAPs to the repository as a test case?

simsong avatar Feb 24 '14 13:02 simsong

Yes

ibeex avatar Feb 24 '14 13:02 ibeex