Package: tcpflow Version: 0.21.ds1-7 Severity: wishlist While debugging a web application I noticed that tcpflow was skipping some sessions. A closer look showed that it seems to be skipping sessions for users who use ipv6. Steps to reproduce: 1) tcpflow -r testcase.pcap Expected results: 1) tcpflow creates two files, one for the ipv4 and another for the ipv6 session stored in testcase.pcap. Actual results: 1) tcpflow only creates one file for ipv4: $ tcpflow -r testcase.pcap $ ls 127.000.000.001.39885-127.000.000.001.03000 testcase.pcap More info: 1) tcpdump shows both: $ /usr/sbin/tcpdump -r testcase.pcap reading from file testcase.pcap, link-type EN10MB (Ethernet) 12:37:33.118240 IP localhost.39885 > localhost.3000: Flags [S], seq 3307815265, win 32792, options [mss 16396,sackOK,TS val 19983932 ecr 0,nop,wscale 10], length 0 12:37:33.118255 IP localhost.3000 > localhost.39885: Flags [S.], seq 1879553098, ack 3307815266, win 32768, options [mss 16396,sackOK,TS val 19983932 ecr 19983932,nop,wscale 10], length 0 12:37:33.118262 IP localhost.39885 > localhost.3000: Flags [.], ack 1, win 33, options [nop,nop,TS val 19983932 ecr 19983932], length 0 12:37:33.118494 IP localhost.39885 > localhost.3000: Flags [P.], seq 1:14, ack 1, win 33, options [nop,nop,TS val 19983932 ecr 19983932], length 13 12:37:33.118505 IP localhost.3000 > localhost.39885: Flags [.], ack 14, win 32, options [nop,nop,TS val 19983932 ecr 19983932], length 0 12:37:33.118603 IP localhost.39885 > localhost.3000: Flags [F.], seq 14, ack 1, win 33, options [nop,nop,TS val 19983932 ecr 19983932], length 0 12:37:33.157908 IP localhost.3000 > localhost.39885: Flags [.], ack 15, win 32, options [nop,nop,TS val 19983942 ecr 19983932], length 0 12:37:33.619232 IP localhost.3000 > localhost.39885: Flags [F.], seq 1, ack 15, win 32, options [nop,nop,TS val 19984057 ecr 19983932], length 0 12:37:33.619268 IP localhost.39885 > localhost.3000: Flags [.], ack 2, win 33, options [nop,nop,TS val 19984057 ecr 19984057], length 0 12:37:57.623466 IP6 ::1.36781 > ::1.3000: Flags [S], seq 1851150570, win 32752, options [mss 16376,sackOK,TS val 19990058 ecr 0,nop,wscale 10], length 0 12:37:57.623477 IP6 ::1.3000 > ::1.36781: Flags [S.], seq 3532182303, ack 1851150571, win 32728, options [mss 16376,sackOK,TS val 19990058 ecr 19990058,nop,wscale 10], length 0 12:37:57.623484 IP6 ::1.36781 > ::1.3000: Flags [.], ack 1, win 32, options [nop,nop,TS val 19990058 ecr 19990058], length 0 12:37:57.623596 IP6 ::1.36781 > ::1.3000: Flags [P.], seq 1:14, ack 1, win 32, options [nop,nop,TS val 19990058 ecr 19990058], length 13 12:37:57.623604 IP6 ::1.3000 > ::1.36781: Flags [.], ack 14, win 32, options [nop,nop,TS val 19990058 ecr 19990058], length 0 12:37:57.623615 IP6 ::1.36781 > ::1.3000: Flags [F.], seq 14, ack 1, win 32, options [nop,nop,TS val 19990058 ecr 19990058], length 0 12:37:57.661928 IP6 ::1.3000 > ::1.36781: Flags [.], ack 15, win 32, options [nop,nop,TS val 19990068 ecr 19990058], length 0 12:37:58.124283 IP6 ::1.3000 > ::1.36781: Flags [F.], seq 1, ack 15, win 32, options [nop,nop,TS val 19990183 ecr 19990058], length 0 12:37:58.124303 IP6 ::1.36781 > ::1.3000: Flags [.], ack 2, win 32, options [nop,nop,TS val 19990183 ecr 19990183], length 0 -- System Information: Debian Release: 7.0 APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 3.2.0-0.bpo.4-amd64 (SMP w/6 CPU cores) Locale: LANG=C, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages tcpflow depends on: ii libc6 2.13-38
Attachment:
testcase.pcap
Description: application/cap
ii libpcap0.8 1.3.0-1 tcpflow recommends no packages. Versions of packages tcpflow suggests: ii tcpdump 4.3.0-1 -- no debconf information