Wireshark · Wireshark-users: [Wireshark-users] tshark and reassembly

["KATWALA, KALPESH (ATTLABS)" <kk891r@xxxxxxx>]

All,

 

I am using tshark (version 1.0.8) to do a live capture of SIP and DIAMETER messages.

 

For some of the DIAMETER messages, I have multiple segmented TCP messages.  When I open captured PCAP file via Wireshark, Wireshark re-assembles these segmented TCP messages.  However, when I use tshark to do futher filtering, it doesn't re-assemble these messages and it looses these packets.

 

How do I get the tshark to assemble these packets?

 

Kalpesh.