On 16 nov 2010, at 19:17, Guy Harris wrote:
> On Nov 16, 2010, at 9:58 AM, Stephen Fisher wrote:
>
>> Should TCP reassembly be done when the packet size was limited during
>> capture?
>
> Not unless we can do reassembly with "holes" in the result, which we currently can't do. At least some other dissectors check to make sure, when adding data to the reassembled packet, that all the data they're adding is present.
IMHO reassembly is not very useful when packets have been truncated. So I would prevent TCP reassembly at the TCP level (actually I was under the impression the TCP dissector was doing that already, but I could be mistaken).
Sake
