Ask Your Question
0

Duplicated UDP stream IDs?

asked 2022-12-14 14:38:44 +0000

Hi All,

Could you please tell why I see duplicate stream IDs in Conversations dialog:

image description

These streams have even different IPs and ports. If I filter by this stream ID, I get both streams. Strangely enough, when I set "Assume packets have FCS to "Always"", streams are not duplicated anymore (this PCAP does NOT have FCS included).

PCAP

Wireshark version:

image description

Thanks for any hint!

Vlad

edit retag flag offensive close merge delete

Comments

Can you share the profile? Are there any Packets B -> A?

Chuckc gravatar imageChuckc ( 2022-12-14 15:26:01 +0000 )edit

Hi Chuck,

1) It's just default profile + Stream ID column added: https://drive.google.com/file/d/14xAk...

2) I see that one stream is separated to 2 unidirectional IDs? See for example ID 9 + ID 10, same 5-tuple if I'm not missing something.

Packet_vlad gravatar imagePacket_vlad ( 2022-12-14 16:46:53 +0000 )edit

I was unable to recreate but my "Default" profile looks a lot like my desk - messy.
Will create a clean profile and try again. :-)
Yes - I was guessing but adding up the packet counts I could see in your screen shot resulted in the totals I was seeing here.

Chuckc gravatar imageChuckc ( 2022-12-14 16:55:08 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2022-12-18 00:27:31 +0000

Chuckc gravatar image

When h225 protocol is enabled, the conversation tables are different.
There was something similar with SNMP (9123: SNMP/UDP: SNMP is walking on UDP conversation/stream ID).
If I don't find a fix soon, will open an issue to track this and post a link to it here.

image description

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-12-14 14:38:44 +0000

Seen: 191 times

Last updated: Dec 18 '22