Ethereal-users: Re: [Ethereal-users] How does Tethereal handle desegmentation ?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 04 Nov 2004 10:57:58 -0800
Pierre JUHEN wrote:


if a PDU is divided into more than 1 TCP packet,
how is the desegmented result output ?

- 1 global frame
- more than one frame
- only the last frame ?


"Output" in what sense?

Desegmentation has no effect on the binary "-w" output.
It does have an effect on the text output you get without "-w". Tcpdump still prints each link-layer packet ("frame") separately. The protocol layers from the link layer to the TCP layer are printed for each of those frames. For the protocol running above TCP, the desegmented data will be printed for the last frame only, although if a TCP segment has, for example, all of one packet, followed by the beginning of the next packet, the first packet will be printed for the frame containing the segment, and the second packet will be printed for the frame containing the last data in that packet.