Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

answered 2018-07-12 15:41:03 +0000

cmaynard gravatar image

Currently, there isn't a solution for this; however, there is a mechanism in place that could handle it, but it will require changes to the Wireshark code before this is possible.

I don't know which version of Wireshark you're using, but at least with 2.6 or later you can enable the preference to enforce stricter conversation tracking heuristics to see if that helps.

The preference can be enabled via Edit -> Preferences -> Protocols -> Enable stricter conversation tracking heuristics.

As the tooltip states:

Protocols may use things like VLAN ID
or interface ID to narrow the potential
for duplicate conversations. Currently
only ICMP and ICMPv6 use this
preference to add VLAN ID to
conversation tracking

Anyway, if someone were to extend the strict_conversation_tracking_heuristics preference to include the interface ID in strict conversation tracking, the problem you're facing could be avoided. At the very least, I would recommend that you open a Wireshark Bug Report, asking for this to be implemented. I think this would be very useful.

Currently, there isn't a solution for this; however, there is a mechanism in place that could handle it, but it will require changes to the Wireshark code before this is possible.

I don't know which version of Wireshark you're using, but at least with 2.6 or later you can enable the preference to enforce stricter conversation tracking heuristics to see if that helps.heuristics.

The preference can be enabled via Edit -> Preferences -> Protocols -> Enable stricter conversation tracking heuristics.

As the tooltip states:

Protocols may use things like VLAN ID
or interface ID to narrow the potential
for duplicate conversations. Currently
only ICMP and ICMPv6 use this
preference to add VLAN ID to
conversation tracking

Anyway, if someone were to extend the strict_conversation_tracking_heuristics preference to include the interface ID in strict conversation tracking, the problem you're facing could be avoided. At the very least, I would recommend that you open a Wireshark Bug Report, asking for this to be implemented. I think this would be very useful.