Wireshark mailing list archives
Re: TCP reassembly when packet capture size limited
From: Sake Blok <sake () euronet nl>
Date: Tue, 16 Nov 2010 21:31:29 +0100
On 16 nov 2010, at 19:17, Guy Harris wrote:
On Nov 16, 2010, at 9:58 AM, Stephen Fisher wrote:Should TCP reassembly be done when the packet size was limited during capture?Not unless we can do reassembly with "holes" in the result, which we currently can't do. At least some other dissectors check to make sure, when adding data to the reassembled packet, that all the data they're adding is present.
IMHO reassembly is not very useful when packets have been truncated. So I would prevent TCP reassembly at the TCP level (actually I was under the impression the TCP dissector was doing that already, but I could be mistaken). Sake ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- TCP reassembly when packet capture size limited Stephen Fisher (Nov 16)
- Re: TCP reassembly when packet capture size limited Guy Harris (Nov 16)
- Re: TCP reassembly when packet capture size limited Sake Blok (Nov 16)
- Re: TCP reassembly when packet capture size limited Guy Harris (Nov 16)