Wireshark-users: Re: [Wireshark-users] Identification of Fragmented UDP Packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Eddie <stunnel@xxxxxxxxxxxxx>
Date: Thu, 21 Jan 2010 19:34:29 -0800
Guy Harris wrote:

..."16-17" for the LAN capture and "17-18" for the WAN capture.

Then enter a file name and click "Save"; that should save a file with only the two packets in question in it.
Then browse to a directory into which you can save the file, 
http://www.BogoLinux.net/LANFragment.cap
http://www.BogoLinux.net/WANFragment.cap

OK, the header checksums are all valid (all four packets).  However, the packets in the WAN capture *might* have been cut short by a snapshot length.  If you can't save the offending packets and send them to us, can you indicate what's in the "Frame" portion of the packet detail pane for packet 17 in the WAN capture?  In particular, what are the "Frame Length" and "Capture Length" values?
I foolishly followed the WireShark manual, and followed it's instructions, for tcpdump, to capture the complete packets. Except it doesn't. LOL 

Frame Length:  1514
Capture Length:  1500

Maybe the doc needs updating.  :)

Cheers.