Skip to content
Snippets Groups Projects

tcp.flags.syn does not filter packets correctly

    • Closed Issue created by Wireshark GitLab Migration @ws-gitlab-migration

    This issue was migrated from bug 1175 in our old bug tracker.

    Original bug information:

    Reporter: Stephen Fletcher
    Status: RESOLVED NOTABUG
    Product: Wireshark
    Component: GTK+ UI
    OS: Windows XP
    Platform: x86
    Version: 0.99.3

    To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

    Child items 0

    • No child items are currently assigned. Use child items to break down this issue into smaller parts.

    Activity

    • Wireshark GitLab Migration
      Wireshark GitLab Migration @ws-gitlab-migration ·
      Author

      :speech_balloon: Stephen Fletcher said:

      Build Information: Version 0.99.3 (SVN Rev 19011)

      Copyright 1998-2006 Gerald Combs <gerald@‍wireshark.org> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

      Compiled with GTK+ 2.6.9, with GLib 2.6.6, with WinPcap (version unknown), with libz 1.2.3, with libpcre 6.4, with Net-SNMP 5.3.1, with ADNS, with Lua 5.1.

      Running with WinPcap version 3.1 (packet.dll version 3, 1, 0, 27), based on libpcap version 0.9[.x] on Windows XP Service Pack 2, build 2600.

      Wireshark is Open Source Software released under the GNU General Public License.

      Check the man page and http://www.wireshark.org for more information.

      When doing an expression search on tcp.flags.syn, packets without the syn flag are displayed
    • Wireshark GitLab Migration added oswindows uigtk version0.x labels

      added oswindows uigtk version0.x labels

    • Wireshark GitLab Migration
      Wireshark GitLab Migration @ws-gitlab-migration ·
      Author

      :speech_balloon: Jaap Keuter said:

      This does not block development of Wireshark: Severity set to normal. Every tcp packet has a sync flag, it's just not set in all of them. So tcp.flags.syn works for every TCP packet, tcp.flags.syn==1 works for TCP packets with sync flag set.

    • Wireshark GitLab Migration
      Wireshark GitLab Migration @ws-gitlab-migration ·
      Author

      :speech_balloon: Guy Harris said:

      I.e., even for Boolean fields, a filter subexpression containing a field's name tests only whether the field is *present*, so, for a Boolean field, it evaluates as "true" if the field is present in a capture, regardless of whether its value is true or false; you have to compare a Boolean field's value against 0 to test whether it's false or against 1 to test whether it's true.

This is by design.
    • Wireshark GitLab Migration closed

      closed

    Please register or sign in to reply