Wireshark-dev: [Wireshark-dev] TCP reassembly when packet capture size limited
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Tue, 16 Nov 2010 10:58:42 -0700
Should TCP reassembly be done when the packet size was limited during 
capture?  Richard Scheffenegger sent a message to the wireshark-users 
mailing list with this error that he's seeing:

Warn Dissector bug, protocol TCP, in packet 6: reassemble.c:929: failed 
assertion "tvb_bytes_exist(tvb, offset, frag_data_len)"

This is because his capture file (sent to me privately due to size) is 
limited to 200 bytes per packet.  The HTTP dissector is trying to 
reassemble a response, but it fails when it runs out of data because 
most of the repose data isn't in the packet capture.

Should we disable TCP reassembly when the packet size is limited or have 
another mechanism to detect if enough data was captured to reassemble 
the whole message?