0

I am capturing a pop3 netcat connection (port 110) using Wireshark, on Debian linux (Kali). After filtering packets with (tcp.port eq 110) I get few packets but once I R.Click on any and click "Follow TCP Stream" I get empty window!

My question, is this a bug? (I found some ppl reporting it as a bug) or is this possible based on some conditions??

I tried to run Wireshark to analyze the pcap file, with root user and with limited user and the result is the same.

On some other packets I still can get contents on the TCP Stream window though.

Improve this question

1 Answer 1

Reset to default
1

Sure, it could be a bug. Alternatively, if no packets containing data (all packets are empty) are included in the TCP stream, you'll also get an empty window.

Improve this answer
1
  • Even if you get an empty data window, you should be able to see the packets associated with the stream in the main window.
    – Dog eat cat world
    Sep 14, 2014 at 11:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .