Wireshark-users: Re: [Wireshark-users] Configure coloring rule for [TCP segment of a reassembled PDU]

From: Sake Blok <sake@xxxxxxxxxx>
Date: Thu, 9 Apr 2009 07:47:12 +0200

On Wed, Apr 08, 2009 at 06:35:57PM -0400, sean bzd wrote:
>    I'm getting a lot of [TCP segment of a reassembled PDU] messages. These
>    are expected and I understand why this is happening. I'm wondering if
>    there is a way to identify them and configure a coloring rule. Any ideas?
>    Appreciate any help. 

You can use the filter "tcp.reassembled_in" in your coloring rule (see
the users guide on how to add a coloring rule). Unfortunately however,
there seems to be a bug in the tcp-dissecter that does not add this
field to the first fragment of a reassembled PDU.

(I will have a look at the tcp-dissector to see whether it can be easily
fixed)

Cheers,
     Sake