Wireshark · Wireshark-users: Re: [Wireshark-users] Assembling of fragmented IP protocol packets

["Franz Edler" <franz.edler@xxxxxxxx>]

Thanks again. You are right. The packets are cut after 1500 bytes.

The problem is now at Linux tcpdump which was the tool that produced the
trace.

Best regards
Franz

> -----Original Message-----
> From: Anders Broman [mailto:a.broman@xxxxxxxxx]
> Sent: Tuesday, April 24, 2007 8:13 PM
> To: franz.edler@xxxxxxxx; 'Community support list for Wireshark'
> Subject: SV: [Wireshark-users] Assembling of fragmented IP protocol
> packets
> 
> Hi,
> From what I can se there is no second fragment in the trace, hence no
> reassembly.
> Best regards
> Anders
> 
> -----Ursprungligt meddelande-----
> Från: wireshark-users-bounces@xxxxxxxxxxxxx
> [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] För Franz Edler
> Skickat: den 24 april 2007 19:25
> Till: 'Anders Broman (AL/EAB)'; 'Community support list for Wireshark'
> Ämne: Re: [Wireshark-users] Assembling of fragmented IP protocol packets
> 
> > How about Edit->preferences->Protocols->IP Reassemble Fragmented IP
> > datagrams = True ?
> 
> Thanks. This has an effect.
> If IP Reassemble Fragmented IP datagrams = false (not checked) than the
> packets are assembled, otherwise not.
> 
> I have attached a small tracefile with some fragmented packets (e.g.
> packet
> No. 4).
> 
> Cheers
> Franz