Wireshark-users: Re: [Wireshark-users] display filter to 'not see' TCP segment of a reassembled P
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Fri, 10 Aug 2012 23:24:19 +0200
On 8 aug 2012, at 18:05, sean bzd wrote:

I'm looking at some traffic where there are a lot of "TCP segment of a reassembled PDU". 
I want to look at the reassembled PDU ONLY and not the individual segments that made up the PDU. Is there any display filter I can use for this.  I have the "Allow subdissector to reassemble TCP streams" checkbox checked.

When you know the protocol, you can just filter on the higher layer protocol. So for http you cab filter with "http". You can also exclude the segments with "!tcp.reassembled_in", however, the first segment is still shown, which can be considered a bug.

Cheers,
Sake