Wireshark · Ethereal-dev: [Ethereal-dev] decode NetMeeting packet

["li" <li_shunda@xxxxxxx>]

I use Ethereal to decode NetMeeting packet, NetMeeting always send TPKT header first which contain the PDU length, then wait for the ACK, after get the ACK, it will send the H.225 signalling to establish the connection.

 

Client              Server

------------------------> send TPKT header

<----------------------- send ACK

------------------------>send H.225 Setup(contain PDU)

 

Ethereal decode first packet "Desegmented TCP", and merge the third packet with the first packet, which mean insert TPKT header, then decode it as:

 

 

 

 

but the third packet's "Fragment Offset" is 0, why insert this header?

 

 

Regards,

 

Frank Li