Thanks again. You are right. The packets are cut after 1500 bytes.
The problem is now at Linux tcpdump which was the tool that produced the
trace.
Best regards
Franz
> -----Original Message-----
> From: Anders Broman [mailto:a.broman@xxxxxxxxx]
> Sent: Tuesday, April 24, 2007 8:13 PM
> To: franz.edler@xxxxxxxx; 'Community support list for Wireshark'
> Subject: SV: [Wireshark-users] Assembling of fragmented IP protocol
> packets
>
> Hi,
> From what I can se there is no second fragment in the trace, hence no
> reassembly.
> Best regards
> Anders
>
> -----Ursprungligt meddelande-----
> Från: wireshark-users-bounces@xxxxxxxxxxxxx
> [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] För Franz Edler
> Skickat: den 24 april 2007 19:25
> Till: 'Anders Broman (AL/EAB)'; 'Community support list for Wireshark'
> Ämne: Re: [Wireshark-users] Assembling of fragmented IP protocol packets
>
> > How about Edit->preferences->Protocols->IP Reassemble Fragmented IP
> > datagrams = True ?
>
> Thanks. This has an effect.
> If IP Reassemble Fragmented IP datagrams = false (not checked) than the
> packets are assembled, otherwise not.
>
> I have attached a small tracefile with some fragmented packets (e.g.
> packet
> No. 4).
>
> Cheers
> Franz
