Wireshark mailing list archives
TCP reassembly when packet capture size limited
From: Stephen Fisher <steve () stephen-fisher com>
Date: Tue, 16 Nov 2010 10:58:42 -0700
Should TCP reassembly be done when the packet size was limited during capture? Richard Scheffenegger sent a message to the wireshark-users mailing list with this error that he's seeing: Warn Dissector bug, protocol TCP, in packet 6: reassemble.c:929: failed assertion "tvb_bytes_exist(tvb, offset, frag_data_len)" This is because his capture file (sent to me privately due to size) is limited to 200 bytes per packet. The HTTP dissector is trying to reassemble a response, but it fails when it runs out of data because most of the repose data isn't in the packet capture. Should we disable TCP reassembly when the packet size is limited or have another mechanism to detect if enough data was captured to reassemble the whole message? ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- TCP reassembly when packet capture size limited Stephen Fisher (Nov 16)
- Re: TCP reassembly when packet capture size limited Guy Harris (Nov 16)
- Re: TCP reassembly when packet capture size limited Sake Blok (Nov 16)
- Re: TCP reassembly when packet capture size limited Guy Harris (Nov 16)