Guy Harris wrote:
..."16-17" for the LAN capture and "17-18" for the WAN capture.
Then enter a file name and click "Save"; that should save a file with only the two packets in question in it.
Then browse to a directory into which you can save the file,
http://www.BogoLinux.net/LANFragment.cap
http://www.BogoLinux.net/WANFragment.cap
OK, the header checksums are all valid (all four packets). However, the packets in the WAN capture *might* have been cut short by a snapshot length. If you can't save the offending packets and send them to us, can you indicate what's in the "Frame" portion of the packet detail pane for packet 17 in the WAN capture? In particular, what are the "Frame Length" and "Capture Length" values?
I foolishly followed the WireShark manual, and followed it's
instructions, for tcpdump, to capture the complete packets. Except it
doesn't. LOL
Frame Length: 1514
Capture Length: 1500
Maybe the doc needs updating. :)
Cheers.
