Wireshark · Wireshark-dev: Re: [Wireshark-dev] Is there reassembly for the IP fragments?

[Sake Blok <sake@xxxxxxxxxx>]

On Sun, Dec 02, 2007 at 01:20:12PM +0100, Ulf Lamping wrote:
> Guy Harris schrieb:
> > prashanth joshi wrote:
> >   
> >> I am curious to know whether there is reassembly of the IP datagram at 
> >> the IP layer.
> >
> > Yes, Ethereal/Wireshark has done that for many years.  You should turn 
> > on the "Reassemble fragmented IP datagrams" preference for IP and, for 
> > IPv6, the "Reassemble fragmented IPv6 datagrams" preference.
>   
> Would it make sense to change the defaults here? The dissection is 
> currently quite confusing when IP fragmentation actually takes place.
> 
> I know this takes some additional memory, but we probably shouldn't 
> sacrifice functionality for memory usage - most people I've talked about 
> Wireshark won't deal with that much data.

I think you are right, the default behaviour should give the user as
much functionality as possible.

> We might need to have a collection of "preferences to tweak, if you are 
> running out of memory" anyway ...

What about starting a wiki-page with all kinds of tuning tips:

- tuning for speed
- tuning for memory usage
- tuning for RTP (heuristic dissectors)

What also comes to mind is a separate performance preferences page with 
all the preferences that impact performance. This would mean having
those preferences in two windows, the protocol preferences and the
performance preferences, can that be done easily?

Cheers,
    Sake