Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Extending time before 2nd analysis pass

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 27 Apr 2019 21:31:57 -0700
On Apr 26, 2019, at 3:02 AM, Darien Spencer <cusneud@xxxxxxxx> wrote:

> I wrote a custom C dissector involving my own re-assembly logic.
> The problem I'm dealing with is:
> When capturing from high-capacity interfaces sometimes the segments to re-assemble arrive out of order

Do they arrive out of order at the protocol implementation as well?

If so, presumably the reassembly process in the protocol implementation knows when it's ready to provide reassembled data to its client; the reassembly code for the Wireshark dissector should do the same thing.