Wireshark-dev: Re: [Wireshark-dev] Is there reassembly for the IP fragments?

From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Sun, 02 Dec 2007 13:20:12 +0100

Guy Harris schrieb:

prashanth joshi wrote:

I am curious to know whether there is reassembly of the IP datagram at the IP layer.

Yes, Ethereal/Wireshark has done that for many years. You should turn on the "Reassemble fragmented IP datagrams" preference for IP and, for IPv6, the "Reassemble fragmented IPv6 datagrams" preference.

Would it make sense to change the defaults here? The dissection is currently quite confusing when IP fragmentation actually takes place.

I know this takes some additional memory, but we probably shouldn't sacrifice functionality for memory usage - most people I've talked about Wireshark won't deal with that much data.

We might need to have a collection of "preferences to tweak, if you are running out of memory" anyway ...

Regards, ULFL