Re: Identification of Fragmented UDP Packets

[Eddie <stunnel () attglobal net>]

Guy Harris wrote:
> There isn't anything obvious that should cause Wireshark not to attempt reassembly, but I didn't check the IP header 
> checksum - is Wireshark reporting IP checksum errors on any of the WAN packets?
>   
Nope:
Header checksum: 0xa746 [correct]
Header checksum: 0xc971 [correct]
> Can you save just the two offending fragments from the WAN capture to a file?  If so, when you read the file in, does 
> it reassemble the fragments?  If not, could you send us that capture, along with the version information from 
> Wireshark?
>   
Not sure what you mean by this.  Can you explain a little more please.

I've also uploaded a couple of screen shots, which hopefully reinforce 
my descriptions of what I'm seeing.  On the LAN, it's packets 16 and 
17.  The WAN is 17 and 18.

http://www.BogoLinux.net/LANFragments.png
http://www.BogoLinux.net/WANFragments.png

I'm running WireShark:  Version 1.2.5 (SVN Rev 31296)

Cheers.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe