Wireshark on macOS not showing full Info column for FCP reassembly errors

  • retag add tags

My pcap file is missing data(error data in the info column) when opened on MacOs. I've tried version 3 and 2.x with no luck. The file shows all the data when opened on a Windows machine.

Thanks in advance for the help.

jtambor's avatar
1
jtambor
asked 2019-04-02 19:01:49 +0000
Guy Harris's avatar
19.9k
Guy Harris
updated 2019-04-04 01:25:25 +0000
edit flag offensive 0 remove flag close merge delete

Comments

1

What do you mean by "error data in the info column"? What is the exact text displayed in the Info column?

Guy Harris's avatar Guy Harris (2019-04-03 07:30:35 +0000) edit
more
  • delete

Guy,
On my mac, the info column for row 1024 for example, shows "FCP (FRAGMENTED)".

The same row on windows shows "FCP (FRAGMENTED) [Reassembly error, protocol FC: New fragment overlaps old data (retransmission?)]" in the info column. Its reasonable that the info is hidden somehow but I cannot figure it out.

Thanks

jtambor's avatar jtambor (2019-04-03 15:51:06 +0000) edit
more
  • delete

And you're using the same version of Wireshark on both machines, and you've set all the preferences for protocols to the same values on both machines?

What does the Protocol column say?

Guy Harris's avatar Guy Harris (2019-04-03 18:46:31 +0000) edit
more
  • delete

I'm using the same version on both machines( I tried 2 different version on my mac just to see). As far as I can tell, the prefs are identical. On both systems, the protocol column shows "FC".

jtambor's avatar jtambor (2019-04-03 19:10:00 +0000) edit
more
  • delete
add a comment see more comments