On Wed, Apr 08, 2009 at 06:35:57PM -0400, sean bzd wrote:
> I'm getting a lot of [TCP segment of a reassembled PDU] messages. These
> are expected and I understand why this is happening. I'm wondering if
> there is a way to identify them and configure a coloring rule. Any ideas?
> Appreciate any help.
You can use the filter "tcp.reassembled_in" in your coloring rule (see
the users guide on how to add a coloring rule). Unfortunately however,
there seems to be a bug in the tcp-dissecter that does not add this
field to the first fragment of a reassembled PDU.
(I will have a look at the tcp-dissector to see whether it can be easily
fixed)
Cheers,
Sake
