Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

This is most likely a false match in the thrift_tcp heuristic check.
epan/dissectors/packet-thrift.c:

/* Check that the 2-byte value match a Thrift TCompactProtocol version
 * - 0x82 The protocol id.
 * - 0bmmmvvvvv The method on the 3 MSbits and version on the 5 LSbits.
 */

The first two bytes (8261) of the Reassembled TCP Data will match the check for
#define THRIFT_COMPACT_VERSION_1 0x8201 when the mask
#define THRIFT_COMPACT_VERSION_MASK 0xff1f is applied.

You can disable the thrift_tcp dissector at Analyze->Enable Protocols....
Search for thrift then uncheck thrift_tcp.