tcpdump
tcpdump copied to clipboard
Question about quic printer
@rpaulo With the attached pcap, tcpdump prints:
$ ./tcpdump -#nv -r merge-request-268-q46_ack.pcapng
reading from file ../pcap-files/wireshark-menagerie/merge-request-268-q46_ack.pcapng, link-type EN10MB (Ethernet), snapshot length 65535
1 15:15:25.415546 IP (tos 0x0, ttl 63, id 3862, offset 0, flags [DF], proto UDP (17), length 1378)
185.217.151.45.27940 > 134.148.213.244.443: quic, initial, v51303436, length 3029401132267995136 [|quic]
length 3029401132267995136, really?
tshark shows it as GQUIC, You should have a look.
The printer doesn’t support Google QUIC packets, only IETF QUIC.
Thus, it should display unsupported for such packets.
Or gquic (unsupported) ...
Okay, but I wonder if it's worth the effort since in the near future the Google QUIC packet format will go away.
We just don't want print incorrect informations.