Wireshark-dev: [Wireshark-dev] HTTP reassembly?
From: Yang Ning <[email protected]>
Date: Wed, 25 Mar 2009 20:31:45 -0400
I noticed that for the http dissection, The http OK message is displayed at the end of stream as opposed to the begginning. 

Can someone point me in the right direction as to how wireshark is doing this? 

Where is the reassembly information is being stored? and where is the reassembly is taking place(tcp or http?) Where is it keeping track of all this? (pinfo?)