Wireshark-dev: Re: [Wireshark-dev] How to capture all IP fragments?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 29 Apr 2008 13:59:37 -0700

On Apr 29, 2008, at 9:48 AM, Maynard, Chris wrote:


In Wireshark, if I want to capture UDP traffic on a specific port (say
port 50000 for purposes of this discussion), I can easily set a capture filter as "udp port 50000", and I get all the traffic I'm interested in, 
including all IP fragments.
Only if you don't have any fragmented IP datagrams. If you get any fragments other than the first fragment with that capture filter, that would be a miracle.
So, how does Wireshark handle this? I guess there is some magic filter "behind the scenes" similar to what I have shown above for capturing IP 
fragments that takes care of the IP fragment capturing as well?
Nope. It handles it by not handling it; as indicated, perhaps some miracle happened, but Wireshark just passes the capture filter on to pcap_compile().