Wireshark-dev: Re: [Wireshark-dev] Fragmented, truncated packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 1 Sep 2011 21:53:07 -0700
On Sep 1, 2011, at 1:09 PM, Glenn Matthews wrote:

> I'm working on a new dissector for a TCP-based protocol. I think I've got the dissector successfully handling fragmented packets (using tcp_dissect_pdus), and I think I've got the dissector successfully handling truncated packets ("packet size limited during capture") but what do I need to do for captures where both apply?

Add support for reassembly of cut-off-by-the-snaplen packets to Wireshark.

I.e.:

> Is this a known limitation in Wireshark,

Yes.

It might be possible to remove that limitation, but it'd probably be tricky.  I'd suggest using "-s 0" as the argument to tcpdump when capturing (the "96" sounds suspiciously like the default snapshot length for IPv6-capable tcpdump until the recent changes to default to 65535, that being what you get with "-s 0" in tcpdumps from the past N years for some value of N).