Wireshark mailing list archives

tshark and reassembly


From: "KATWALA, KALPESH (ATTLABS)" <kk891r () att com>
Date: Tue, 1 Dec 2009 13:37:36 -0500

All,
 
I am using tshark (version 1.0.8) to do a live capture of SIP and
DIAMETER messages.
 
For some of the DIAMETER messages, I have multiple segmented TCP
messages.  When I open captured PCAP file via Wireshark, Wireshark
re-assembles these segmented TCP messages.  However, when I use tshark
to do futher filtering, it doesn't re-assemble these messages and it
looses these packets.
 
How do I get the tshark to assemble these packets?
 
Kalpesh.
 
 
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

Current thread: