Wireshark on macOS not showing full Info column for FCP reassembly errors

asked 2019-04-02 19:01:49 +0000

jtambor gravatar image

updated 2019-04-04 01:25:25 +0000

Guy Harris gravatar image

My pcap file is missing data(error data in the info column) when opened on MacOs. I've tried version 3 and 2.x with no luck. The file shows all the data when opened on a Windows machine.

Thanks in advance for the help.

edit retag flag offensive close merge delete

Comments

1

What do you mean by "error data in the info column"? What is the exact text displayed in the Info column?

Guy Harris gravatar imageGuy Harris ( 2019-04-03 07:30:35 +0000 )edit

Guy,
On my mac, the info column for row 1024 for example, shows "FCP (FRAGMENTED)".

The same row on windows shows "FCP (FRAGMENTED) [Reassembly error, protocol FC: New fragment overlaps old data (retransmission?)]" in the info column. Its reasonable that the info is hidden somehow but I cannot figure it out.

Thanks

jtambor gravatar imagejtambor ( 2019-04-03 15:51:06 +0000 )edit

And you're using the same version of Wireshark on both machines, and you've set all the preferences for protocols to the same values on both machines?

What does the Protocol column say?

Guy Harris gravatar imageGuy Harris ( 2019-04-03 18:46:31 +0000 )edit

I'm using the same version on both machines( I tried 2 different version on my mac just to see). As far as I can tell, the prefs are identical. On both systems, the protocol column shows "FC".

jtambor gravatar imagejtambor ( 2019-04-03 19:10:00 +0000 )edit
add a comment