Wireshark · Wireshark-dev: Re: [Wireshark-dev] Is there reassembly for the IP fragments?

[Ulf Lamping <ulf.lamping@xxxxxx>]

Guy Harris schrieb:
> prashanth joshi wrote:
>
>   
> > I am curious to know whether there is reassembly of the IP datagram at 
> > the IP layer.
> >     
>
> Yes, Ethereal/Wireshark has done that for many years.  You should turn 
> on the "Reassemble fragmented IP datagrams" preference for IP and, for 
> IPv6, the "Reassemble fragmented IPv6 datagrams" preference.
>   
Would it make sense to change the defaults here? The dissection is 
currently quite confusing when IP fragmentation actually takes place.

I know this takes some additional memory, but we probably shouldn't 
sacrifice functionality for memory usage - most people I've talked about 
Wireshark won't deal with that much data.


We might need to have a collection of "preferences to tweak, if you are 
running out of memory" anyway ...

Regards, ULFL