Ethereal-dev: Re: [Ethereal-dev] Bug: ethereal won't decode first fragment

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 7 Mar 2002 12:36:10 -0800
On Thu, Mar 07, 2002 at 03:12:34PM -0500, Marc Milgram wrote:
> I turned on IP->Reassemble fragmented IP datagrams, then loaded a dump.
> 
> Ethereal read the first fragment of a fragmented packet, but not the
> subsequent fragments.  Ethereal failed to decode the packet past the IP
> level (it recognized that it was a UDP packet, but did not decode the
> UDP, RPC, or NFSV3 protocol layers).
> 
> If I turn off Reassemble fragmented IP datagrams, it will decode the
> fragment correctly.

Are all the fragments present?  If not, it won't reassemble.

Are all the fragments complete, or is the capture length shorter than
the actual length for any of them?  If not, it won't reassemble.

Are the IP checksums valid on all the fragments?  If not, it won't
reassemble.

It definitely *does* reassemble IP fragments on some captures, so it's
not as if the feature isn't working at all; there's definitely
*something* different about your capture.

Note also that the reassembled packet is dissected on the
(chronologically) *last* fragment, not the *first* fragment - the packet
summary will show all but the last fragment as just IP fragments.