Wireshark · Wireshark-dev: Re: [Wireshark-dev] TCP reassembly when packet capture size limited

Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] TCP reassembly when packet capture size limited

From: Guy Harris <guy@xxxxxxxxxxxx>

Date: Tue, 16 Nov 2010 10:17:18 -0800

On Nov 16, 2010, at 9:58 AM, Stephen Fisher wrote:

> Should TCP reassembly be done when the packet size was limited during 
> capture?

Not unless we can do reassembly with "holes" in the result, which we currently can't do.  At least some other dissectors check to make sure, when adding data to the reassembled packet, that all the data they're adding is present.

Follow-Ups:
- Re: [Wireshark-dev] TCP reassembly when packet capture size limited
  - From: Sake Blok

References:
- [Wireshark-dev] TCP reassembly when packet capture size limited
  - From: Stephen Fisher

Prev by Date: Re: [Wireshark-dev] Filter for generated items
Next by Date: Re: [Wireshark-dev] Modify default settings?
Previous by thread: [Wireshark-dev] TCP reassembly when packet capture size limited
Next by thread: Re: [Wireshark-dev] TCP reassembly when packet capture size limited
Index(es):
- Date
- Thread

© Wireshark Foundation · Privacy Policy

Facebook·Mastodon·Twitter·YouTube