Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Wireshark-users: [Wireshark-users] tshark and reassembly

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next


From: "KATWALA, KALPESH (ATTLABS)" <kk891r@xxxxxxx>
Date: Tue, 1 Dec 2009 13:37:36 -0500

All,
 
I am using tshark (version 1.0.8) to do a live capture of SIP and DIAMETER messages.
 
For some of the DIAMETER messages, I have multiple segmented TCP messages.  When I open captured PCAP file via Wireshark, Wireshark re-assembles these segmented TCP messages.  However, when I use tshark to do futher filtering, it doesn't re-assemble these messages and it looses these packets.
 
How do I get the tshark to assemble these packets?
 
Kalpesh.
 
 
  • Prev by Date: [Wireshark-users] question about exporting/filtering files
  • Next by Date: Re: [Wireshark-users] Slow database access
  • Previous by thread: Re: [Wireshark-users] question about exporting/filtering files
  • Next by thread: Re: [Wireshark-users] Slow database access
  • Index(es):
    • Date
    • Thread

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation