Edouard Funke wrote:
The same issue happens with "normal" tcp trafic without any custom
plugin activated.
How can i deactivate reassembly in this case ?
Try adding the command line flag
-o tcp.desegment_tcp_streams:false
which will turn off reassembly for protocols running over TCP. You
could also try
-o ip.defragment:false -o ipv6.defragment:false
to turn off reassembly of fragmented IPv4 and IPv6 datagrams.
How different would be my output ?
If the traffic is, for example, HTTP or SMB, it could be quite
different, as large HTTP replies, and SMB write requests and read
replies, are some examples of PDUs that would be split across TCP
segment boundaries.
