Protocol Hierarchy Statistics shows LDAP lines recursively

This issue was migrated from bug 1734 in our old bug tracker.

Original bug information:

Reporter: Toralf Förster
Status: RESOLVED FIXED
Product: Wireshark
Component: GTK+ UI
OS: Linux
Platform: x86
Version: Git

Attachments:

: a screen shot of the stats window
: screen shot of wireshark window
ldap_stream.pcap: ldap stream

Toralf Förster said:

Build Information: Version 0.99.7 (SVN Rev 22475)

Copyright 1998-2007 Gerald Combs <gerald@‍wireshark.org> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.10.13, with GLib 2.12.12, with libpcap 0.9.5, with libz 1.2.3, with libpcre 6.6, with Net-SNMP 5.2.1.2, without ADNS, without Lua, with GnuTLS 1.4.4, with Gcrypt 1.2.2, without Kerberos, without PortAudio, without AirPcap.

Running on Linux 2.6.21-gentoo-r4, with libpcap version 0.9.5.

Built using gcc 4.1.2 (Gentoo 4.1.2).

Wireshark is Open Source Software released under the GNU General Public License.

Check the man page and http://www.wireshark.org for more information.

I'll attach a screen shot to show what I meant.

added oslinux uigtk versiondev labels

Toralf Förster said:

Created attachment 778 a screen shot of the stats window

Toralf Förster said:

Created attachment 861 screen shot of wireshark window

That window information is rather unuseful at least for the LDAP protocol, isn't it ?

Stephen Fisher said:

Yes, in most (all?) cases this repeating information is not very useful. If I remember correctly,tThis typically happens when there are multiple PDUs in the same packet. Do you have a capture file you would be able to attach that exhibits the problem to help us solve it? Thanks!

Toralf Förster said:

If a single packet is enough you can use the LDAP packet from bug #‍1801 (which btw causes a segfault too). If it is not enough I would prefer to mail you the captured stream directly rather then publishing it to all.

Toralf Förster said:

Created attachment 978 ldap stream

The culprit is related to the protocol preference "Reassemble LDAP messages spanning multiple TCP segments".

Have a look at packet #‍57, switching the protocol option solves the issue with the statistic. Beside that the packet is no longer marked as malformed.

Toralf Förster said:

The current wirshark version shows now only 2x the LDAP within statistics - probably b/c of packet #‍58 ?

Jeff Morriss said:

*** Bug #5310 (closed) has been marked as a duplicate of this bug. ***

Gerrit Code Review said:

Change 14393 had a related patch set uploaded by Michael Mann: Remove most (all?) of the tree view of Protocol Hierarchy Statistics and just list the protocols with their stats.

https://code.wireshark.org/review/14393

Michael Mann said:

*** Bug #9032 (closed) has been marked as a duplicate of this bug. ***

Gerrit Code Review said:

Change 14393 merged by Michael Mann: Walk up the tree view of Protocol Hierarchy Statistics to look for protocol matches.

https://code.wireshark.org/review/14393

Gerrit Code Review said:

Change 14433 had a related patch set uploaded by Michael Mann: Walk up the tree view of Protocol Hierarchy Statistics to look for protocol matches.

https://code.wireshark.org/review/14433

Gerrit Code Review said:

Change 14433 merged by Michael Mann: Walk up the tree view of Protocol Hierarchy Statistics to look for protocol matches.

https://code.wireshark.org/review/14433

closed

mentioned in issue #5310 (closed)

mentioned in issue #9032 (closed)

mentioned in merge request !6650 (merged)