Re: fragmented packets

[Hannes Gredler <hannes () juniper net>]

Luis Del Pino wrote:
> Hello, i have a question. I am filtering UDP segments by port. In fragmented
> packets, i only capture the UDP segment and i can't capture the other
> fragments. My questions are: could the fragments loss? or if a fragment is
> lost in the network, the UDP segment entirely is it lost?. i'm sorry for my
> English.

UDP port numbers are only contained in the first fragment -
and tcpdump does not reassemble fragments
that means you will loose all non-zero fragments.

/hannes
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.