https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4905
--- Comment #10 from Jaap Keuter <jaap.keuter@xxxxxxxxx> 2010-10-09 17:22:30 CEST ---
(In reply to comment #8)
> Additionally, the generated filter doesn't take into account reassembled IP
> fragments. Typically, if a long UDP packet takes 3 IP frames N, N+1, N+2, only
> the (N+2) will appear in the (or frame.number==...) list.
This is inevitable in the current reassembly implementation. If you try to
construct a data link layer filter from application layer messages, you're
isolated from the reassembly at the lower layer. Therefore there is no way to
know which packets were used in the reassembly, thus can't be added to the
filter.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
