Wireshark mailing list archives
tshark and reassembly
From: "KATWALA, KALPESH (ATTLABS)" <kk891r () att com>
Date: Tue, 1 Dec 2009 13:37:36 -0500
All, I am using tshark (version 1.0.8) to do a live capture of SIP and DIAMETER messages. For some of the DIAMETER messages, I have multiple segmented TCP messages. When I open captured PCAP file via Wireshark, Wireshark re-assembles these segmented TCP messages. However, when I use tshark to do futher filtering, it doesn't re-assemble these messages and it looses these packets. How do I get the tshark to assemble these packets? Kalpesh.
___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- tshark and reassembly KATWALA, KALPESH (ATTLABS) (Dec 02)