Ethereal-users: [Ethereal-users] Re: [tcpdump-workers] UDP Fragments

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Hannes Gredler <hannes@xxxxxxxxxxx>
Date: Sat, 11 Mar 2006 17:13:27 +0100
luis,

see the answer to the same questions answered a few weeks before.

bottomline is: tcpdump does not perform fragment reassembly and
there is no way to catch the fragments bases on port numbers.

/hannes

Luis Del Pino wrote:

Hi, I'm Luis del Pino, What filter could I use to capture UDP datagrams and
its fragments?

I have this filter "dst 192.168.0.120 and (udp dst port 10005 or udp dst
port 10006 or udp dst port 10007)" but it doesn't capture the fragments. I
only want capture its fragments and not capture all IP datagrams. i have
thought to use the fields, flag and fragment offset in the IP  datagram.

Thanks
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.