https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4905
--- Comment #12 from Alexandre Ferrieux <alexandre.ferrieux@xxxxxxxxxxxxxxxxxx> 2010-10-11 01:23:07 PDT ---
(In reply to comment #10)
> (In reply to comment #8)
> > Additionally, the generated filter doesn't take into account reassembled IP
> > fragments. Typically, if a long UDP packet takes 3 IP frames N, N+1, N+2, only
> > the (N+2) will appear in the (or frame.number==...) list.
>
> This is inevitable in the current reassembly implementation. If you try to
> construct a data link layer filter from application layer messages, you're
> isolated from the reassembly at the lower layer. Therefore there is no way to
> know which packets were used in the reassembly, thus can't be added to the
> filter.
Ah, but users don't care about API limitations, they just care about filtering
VOIP calls properly in huge traces, to save and send by e-mail; this is
currently impossible as soon as fragmentation occurs.
Don't you think that means that the API should be extended to handle the
situation better ?
As a workaround, I'm currently adding _all_ incomplete fragments with "or":
better to have too many of them than missing important ones. It could be a
starting point until the API is extended...
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
