Wireshark-users: [Wireshark-users] Question about TCP buffering and Wireshark
From: sean bzd <seanbzd@xxxxxxxxx>
Date: Fri, 17 Jul 2009 14:59:28 -0400
TCP experts,
I'm trying to understand some TCP packets sent by my application that
I captured through wireshark. I noticed that multiple send() {winsock
API) calls are being combined into a single TCP frame. My custom
plugin doesn't seem to be able to parse this properly. Is there a
setting in wireshark to show these separately? OR is there something
in the plugin I can do to separate the frame into multiple app
packets??

The otherway around - i.e a large app packet split up into multiple
tcp frames is working fine and I had to do something special in my
plugin to handle this. (reassembled PDUs).

Thanks for your help.