THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Duplicated UDP stream IDs?

Hi All,

Could you please tell why I see duplicate stream IDs in Conversations dialog:

image description

These streams have even different IPs and ports. If I filter by this stream ID, I get both streams. Strangely enough, when I set "Assume packets have FCS to "Always"", streams are not duplicated anymore (this PCAP does NOT have FCS included).

PCAP

Wireshark version:

image description

Thanks for any hint!

Vlad

Packet_vlad's avatar
1.1k
Packet_vlad
asked 2022-12-14 14:38:44 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Can you share the profile? Are there any Packets B -> A?

Chuckc's avatar Chuckc (2022-12-14 15:26:01 +0000) edit
more
  • delete

Hi Chuck,

1) It's just default profile + Stream ID column added: https://drive.google.com/file/d/14xAk...

2) I see that one stream is separated to 2 unidirectional IDs? See for example ID 9 + ID 10, same 5-tuple if I'm not missing something.

Packet_vlad's avatar Packet_vlad (2022-12-14 16:46:53 +0000) edit
more
  • delete

I was unable to recreate but my "Default" profile looks a lot like my desk - messy.
Will create a clean profile and try again. :-)
Yes - I was guessing but adding up the packet counts I could see in your screen shot resulted in the totals I was seeing here.

Chuckc's avatar Chuckc (2022-12-14 16:55:08 +0000) edit
more
  • delete
add a comment see more comments

1 Answer

0

When h225 protocol is enabled, the conversation tables are different.
There was something similar with SNMP (9123: SNMP/UDP: SNMP is walking on UDP conversation/stream ID).
If I don't find a fix soon, will open an issue to track this and post a link to it here.

image description

Chuckc's avatar
3k
Chuckc
answered 2022-12-18 00:27:31 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer