Follow TCP Stream truncates output on missing (but ACKed) segments

This issue was migrated from bug 14944 in our old bug tracker.

Original bug information:

Reporter: Peter Wu
Status: RESOLVED FIXED
Product: Wireshark
Component: Dissection engine (libwireshark)
OS: All
Platform: All
Version: 2.6.1

Attachments:

fake-http.pcap: Packet capture with a HTTP request followed by a TCP ACK from server

Peter Wu said:

Created attachment 16476 Packet capture with a HTTP request followed by a TCP ACK from server

Build Information: TShark (Wireshark) 2.9.0 (v2.9.0rc0-1174-g692849f7)

Copyright 1998-2018 Gerald Combs <gerald@‍wireshark.org> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3, with GLib 2.56.0, with zlib 1.2.11, without SMI, with c-ares 1.14.0, with Lua 5.2.4, with GnuTLS 3.5.18, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.32.0, with LZ4, with Snappy, with libxml2 2.9.8.

Running on Linux 4.17.2-1-ARCH, with Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz (with SSE4.2), with 31988 MB of physical memory, with locale en_GB.UTF-8, with libpcap version 1.8.1, with GnuTLS 3.5.18, with Gcrypt 1.8.3, with zlib 1.2.11, binary plugins supported (13 loaded).

Built using clang 4.2.1 Compatible Clang 6.0.0 (tags/RELEASE_600/final).

Description:
Previously (since bug 592?), if a capture file lost packets but the endpoints ACKed those TCP segments, then the Follow TCP Stream feature would add a special marker in the output. This seems no longer to be the case, now the output is truncated.

To reproduce:
1. Download attached capture file and disable packet 4:

    editcap fake-http.pcap fake-http-missing4.pcap 4
2. Use the Follow TCP Stream option (can also use the GUI feature):

    tshark -r fake-http-missing4.pcap -z follow,tcp,hex,0

Expected result:
...
00000000  47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  GET / HT TP/1.1..
00000010  48 6f 73 74 3a 20 65 78  61 6d 70 6c 65 2e 63 6f  Host: ex ample.co
00000020  6d 0d 0a                                          m..
00000023  41 63 63 65 70 74 3a 20  2a 2f 2a 0d 0a           Accept:  */*..
00000030  5b 33 32 20 62 79 74 65  73 20 6d 69 73 73 69 6e  [32 byte s missin
00000040  67 20 69 6e 20 63 61 70  74 75 72 65 20 66 69 6c  g in cap ture fil
00000050  65 5d                                             e]
00000052  58 2d 4e 6f 74 65 32 3a  20 65 78 70 65 63 74 65  X-Note2:  expecte
00000062  64 20 6d 69 73 73 69 6e  67 20 68 64 72 21 0d 0a  d missin g hdr!..
00000072  0d 0a                                             ..
===================================================================

Actual result:
...
00000000  47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  GET / HT TP/1.1..
00000010  48 6f 73 74 3a 20 65 78  61 6d 70 6c 65 2e 63 6f  Host: ex ample.co
00000020  6d 0d 0a                                          m..
00000023  41 63 63 65 70 74 3a 20  2a 2f 2a 0d 0a           Accept:  */*..
===================================================================

Working versions ("Expected result"):
v2.0.5
v2.1.0rc0-669-ga648921027
...
v2.1.0rc0-1329-g7604371a26

Broken versions ("Actual result"):
v2.1.0rc0-1339-g57acc227f0 ("KISS the Follow TCP functionality.") - bisected
v2.2.16rc0-107-gbc621b7124
v2.4.8rc0-85-g4f8ef405c2
v2.6.2rc0-133-g4080e95d92
v2.9.0rc0-1174-g692849f7ad

Broken in other ways:
v2.1.0rc0-1339-g57acc227f0 and
v2.1.0rc0-1455-gb65d30dbd5 - duplicated and garbage segments

added libwireshark version2.6 labels

Gerrit Code Review said:

Change 28612 had a related patch set uploaded by Peter Wu: tcp: fix Follow TCP Stream with missing (but ACKed) segments

https://code.wireshark.org/review/28612

Gerrit Code Review said:

Change 28618 had a related patch set uploaded by Peter Wu: tests: add regression tests for Follow TCP Stream

https://code.wireshark.org/review/28618

Gerrit Code Review said:

Change 28612 merged by Anders Broman: tcp: fix Follow TCP Stream with missing (but ACKed) segments

https://code.wireshark.org/review/28612

Gerrit Code Review said:

Change 28644 had a related patch set uploaded by Peter Wu: tcp: fix Follow TCP Stream with missing (but ACKed) segments

https://code.wireshark.org/review/28644

Gerrit Code Review said:

Change 28644 merged by Peter Wu: tcp: fix Follow TCP Stream with missing (but ACKed) segments

https://code.wireshark.org/review/28644

Peter Wu said:

Fixed in: v2.9.0rc0-1182-g079d1521 v2.6.2rc0-152-g6fc95019

Not backported to master-2.4, see bug #13700 (closed) comment 7 for the reasoning.

closed