question/concern with followstream decoder about dshell

[amm3]

The followstream decoder itself isn't involved in stream reassembly and/or connection tracking. These functions are handled in lib/dshell.py (the core dshell library).

That said, my guess is that your scenario is explained by an incomplete capture. Dshell by default only processes TCP streams wherein it can track the TCP handshake (SYN-SYNACK-ACK). If your capture contains "mid-stream" packets, those would basically be ignored.

To change this behavior use the "ignore_handshake" decoder option. This is option is somewhat global but is attached to the decoder itself, so you have to invoke it with the encoder prefix. Therefore in followstream, you would add the command-line option: --followstream_ignore_handshake

[dek443]

The Python 2 version of Dshell is now deprecated and frozen as Release v2.4.10. We are closing all Pull Requests and Issues associated with that version, as Dshell development has shifted to the current version for Python 3. Thank you for your support.