RE: [Ethereal-users] Info column changed for (PSH, ACK) messages.

["Royce Fessenden" <rfessenden@xxxxxxx>]

Turning off "Allow subdissectors to reassemble TCP packets" did set it back
to displaying [PSH, ACK].  However, I have no idea what protocol it was
trying to subdissect.  (In this case, the data was coming in on port 2001
and was not a standard protocol.)

At any rate, you solved the problem, and increased my understanding.

Thanks,

Royce



-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx
[mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Guy Harris
Sent: Monday, June 05, 2006 9:59 PM
To: Ethereal user support
Subject: Re: [Ethereal-users] Info column changed for (PSH, ACK) messages.

Royce Fessenden wrote:
> When the TCP flags byte is 0x0018 (PSH, ACK)  PSH,ACK used to display in
> the info column.  Now it says, "TCP segment of a reassembled PDU".

It should do that only if some dissector thinks the data in the TCP
segment is for its protocol, and it's doing TCP reassembly.

> Was that a deliberate change?

Probably.  Perhaps support for a new protocol was added, so that, in older
versions of Ethereal, it didn't dissect the data past the TCP header, and
now it dissects it as some protocol.

> Is there any way to get the old display back?

Disable the dissector for that protocol.  You might have to turn TCP
reassembly off (it's one of the preferences for TCP) in order to determine
what the protocol is.


_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users