 | 1 | initial version |
TCP stream 47 does not contain a full HTTP response (as the client sends a TCP/RST right after the request). This means the HTTP dissector will not be able to reassemble the HTTP response, as there is data missing. You can see that there is no HTTP response in the packet-list. As follow-http-stream relies on the http dissector to collect full HTTP requests and responses it can't show the snippet of the http response that was sent before the TCP/RST was received by the server.
The reason it does work with reassembly turned off, is that then the http dissector only needs the first part of the response to mark that packet as the http-response.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
