Wireshark-users: Re: [Wireshark-users] Assembling of fragmented IP protocol packets
From: "Franz Edler" <[email protected]>
Date: Tue, 24 Apr 2007 20:21:38 +0200
Thanks again. You are right. The packets are cut after 1500 bytes.

The problem is now at Linux tcpdump which was the tool that produced the
trace.

Best regards
Franz

> -----Original Message-----
> From: Anders Broman [mailto:[email protected]]
> Sent: Tuesday, April 24, 2007 8:13 PM
> To: [email protected]; 'Community support list for Wireshark'
> Subject: SV: [Wireshark-users] Assembling of fragmented IP protocol
> packets
> 
> Hi,
> From what I can se there is no second fragment in the trace, hence no
> reassembly.
> Best regards
> Anders
> 
> -----Ursprungligt meddelande-----
> Från: [email protected]
> [mailto:[email protected]] För Franz Edler
> Skickat: den 24 april 2007 19:25
> Till: 'Anders Broman (AL/EAB)'; 'Community support list for Wireshark'
> Ämne: Re: [Wireshark-users] Assembling of fragmented IP protocol packets
> 
> > How about Edit->preferences->Protocols->IP Reassemble Fragmented IP
> > datagrams = True ?
> 
> Thanks. This has an effect.
> If IP Reassemble Fragmented IP datagrams = false (not checked) than the
> packets are assembled, otherwise not.
> 
> I have attached a small tracefile with some fragmented packets (e.g.
> packet
> No. 4).
> 
> Cheers
> Franz