Wireshark-bugs: [Wireshark-bugs] [Bug 3315] Segments of reassembled PDU's not saved when saving
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3315
--- Comment #19 from Jon C <jon.carmicheal@xxxxxxxxx> 2012-02-23 12:57:54 PST ---
(In reply to comment #18)
> "Fragmented IP Protocol error"? Fragmented IP isn't an error (though it's also
> not a good idea to use!), so I assume you mean that not all of the IP fragments
> were saved to the new capture file and thus your SIP messages didn't get
> (fully) saved to the new capture file? That's strange since saving all the
> packets (as would be the case when selecting "Displayed" with no display filter
> active) should not exclude any packets. You could verify this by comparing the
> frame counts between the two files.
Sorry, my bad. Your assumption is correct. I don't know what I was seeing
earlier, but I just checked again. Saving the "displayed" packets with no
filter was the same as saving the "captured" packets in the Save As dialog.
The issue came from filtering on SIP which did not capture the 3 IP packets
that comprised the reassembled IPv4 packet (which was displayed as SIP).
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.
