 | 1 | initial version |
The problem is very likely that the 5-tuples are the same and Wireshark isn't taking into account additional information such as the capture interface when tracking conversations. There is a Wireshark preference to "Enable stricter conversation tracking heuristics" that could be expanded to include the interface in tracking conversations, but every protocol that tracks conversations would have to be modified to make use of it. Obviously, some protocols such as TCP would be good candidates to start with. Alternatively, the "Enable stricter conversation tracking heuristics" preference could be split into separate preferences that allow for more fine-tuning of conversation tracking.
In any case, filing an enhancement bug report on the Wireshark Bug Tracker asking for the interface to be included in conversation tracking is probably the best path for a resolution to this problem.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
