Sake,
Thanks a lot. That helped. Like you said, this doesn't work for the
first fragment of a reassembled PDU; but thats OK for now. Looking
through the archives, someone suggested a fix for the this first
fragment problem:
http://www.wireshark.org/lists/wireshark-bugs/200902/msg00260.html
>On Wed, Apr 08, 2009 at 06:35:57PM -0400, sean bzd wrote:
>> I'm getting a lot of [TCP segment of a reassembled PDU] messages. These
>> are expected and I understand why this is happening. I'm wondering if
>> there is a way to identify them and configure a coloring rule. Any ideas?
>> Appreciate any help.
>You can use the filter "tcp.reassembled_in" in your coloring rule (see
>the users guide on how to add a coloring rule). Unfortunately however,
>there seems to be a bug in the tcp-dissecter that does not add this
>field to the first fragment of a reassembled PDU.
>(I will have a look at the tcp-dissector to see whether it can be easily
fixed)
>Cheers,
>Sake
