Wireshark · Ethereal-dev: Re: [Ethereal-dev] How is HTTP desegmentation supposed to work?

["Guy Harris" <gharris@xxxxxxxxx>]

Kelly Byrd said:
> I've been trying to get http body desegmentation to work,
> and I stumbled on the "Protocols->TCP->Allow subdissector to desgement
> TCP streams" option. Desegmenting works if this option and the http
> desegement body option are both enabled. Is this by design?

Yes.

> The lower-level TCP desegment option has to be enabled for http
desegmenting to
> work?

Yes.

The lower-level TCP desegmentation option has to be enabled for reassembly
of *any* protocol running directly atop TCP to work.

Most reassembly takes place at the lower protocol layer, e.g. IP
defragmentation; this allows reassembly for that protocol to be turned off
(if, for example, there's a reassembly bug that causes crashes or other
problems, or attempting to do reassembly would cause Ethereal to run out
of memory) or on with one switch.

TCP knows nothing about higher-level protocol boundaries, so it can't do
all the work of reassembly.  We generally have preference settings in both
the higher-level protocol and TCP, where the latter lets you turn
reassembly off for *all* TCP-based protocols.

Perhaps the higher-level protocols should have no reassembly preference
(some already don't), with the TCP preference being the only one, along
the lines of other forms of reassembly.