Wrong export (save as) of TCP-stream

This issue was migrated from bug 11877 in our old bug tracker.

Original bug information:

Reporter: Andrey
Status: VERIFIED WORKSFORME
Product: Wireshark
Component: Dissection engine (libwireshark)
OS: OS X 10.10
Platform: x86-64
Version: 2.0.0

Attachments:

fftp.pcap: captured traff

Andrey said:

Created attachment 14140 captured traff

Build Information: Wireshark 2.0.0 (v2.0.0-0-g9a73b82 from master-2.0)

Copyright 1998-2015 Gerald Combs <gerald@‍wireshark.org> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.3.2, with libpcap, without POSIX capabilities, with libz 1.2.5, with GLib 2.36.0, with SMI 0.4.8, without c-ares, without ADNS, with Lua 5.2, with GnuTLS 2.12.19, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP, with QtMultimedia, without AirPcap.

Running on Mac OS X 10.10.5, build 14F1505 (Darwin 14.5.0), with locale C, with libpcap version 1.5.3 - Apple version 47, with libz 1.2.5, with GnuTLS 2.12.19, with Gcrypt 1.5.0. Intel(R) Core(TM) i7-4850HQ CPU @ 2.30GHz (with SSE4.2)

Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build 2336.9.00).

I'm filtered ftp-data from traffic (attached).
Follow TCP-stream for that.
Then i'm Save stream as fff.zip

Rersult: zip is corrupted. It can't be open.
md5 = 92987aebbca78638d8377043ab5cec8c
size is 15117 b (!sic)

!!! If i'm do this action on Win7 & Wireshark 1.12.8 all exported correctly.
md5 = ad39f4e3e77ae1fb6eb5a90706e8bdab
Size is 75917 b (!sic)

capetured traff

added libwireshark osmacos version2.0 labels

Pascal Quantin said:

Using the attached capture with both Wireshark 2.0 and Wireshark 1.12, the ftp-data filter gives 11 packets. Follow TCP stream and export as raw data gives the exact same zip file of 14.7KB that is perfectly valid.

Be careful: Wireshark 2 Follow TCP stream window selects by default ASCII display. Ensure to select Raw in the drop box before saving the payload.

Andrey said:

(In reply to Pascal Quantin from comment #1)  
> Using the attached capture with both Wireshark 2.0 and Wireshark 1.12, the  
> ftp-data filter gives 11 packets. Follow TCP stream and export as raw data  
> gives the exact same zip file of 14.7KB that is perfectly valid.  
>  
> Be careful: Wireshark 2 Follow TCP stream window selects by default ASCII  
> display. Ensure to select Raw in the drop box before saving the payload.  

Ok, after choose RAW format all works correctly. thank you

Alexis La Goutte said:

There is also a another limitation about the size of display data on follow window ?

Pascal Quantin said:

(In reply to Alexis La Goutte from comment #‍3)
> There is also a another limitation about the size of display data on follow
> window ?

This is just what is displayed in the window (not what is exported) and tracked by bug #11777 (closed) (which as the same root cause as the slowness of the window).

Pascal Quantin said:

*** Bug #11904 (closed) has been marked as a duplicate of this bug. ***

closed

mentioned in issue #11904 (closed)