Wireshark · Wireshark-dev: Re: [Wireshark-dev] PDML export on big capture files

[Guy Harris <guy@xxxxxxxxxxxx>]

Edouard Funke wrote:
> The same issue happens with "normal" tcp trafic without any custom
> plugin activated.
> How can i deactivate reassembly in this case ?

Try adding the command line flag

	-o tcp.desegment_tcp_streams:false

which will turn off reassembly for protocols running over TCP.  You 
could also try

	-o ip.defragment:false -o ipv6.defragment:false

to turn off reassembly of fragmented IPv4 and IPv6 datagrams.

> How different would be my output ?

If the traffic is, for example, HTTP or SMB, it could be quite 
different, as large HTTP replies, and SMB write requests and read 
replies, are some examples of PDUs that would be split across TCP 
segment boundaries.