Wireshark · Ethereal-dev: [Ethereal-dev] Re: [Ethereal-users] Saving reassembled IP packets?

[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Apr 13, 2004 at 05:49:22PM +0200, Biot Olivier wrote:
> And to complicate things even more, there will probably be packets that do
> not participate in the reassembly as such (TCP ACK, TCP SYN, ...) but which
> may contain important information for the dissection.

...which is even an issue if there's no reassembly being done - there's
no guarantee in general that, if you save a file with a subset of the
packets in the capture, the remaining packets will be dissected the same
way they were in the original capture, as state information obtained by
dissecting the unsaved packets might affect the way the other packets
are dissected.