Re: Identification of Fragmented UDP Packets

[Eddie <stunnel () attglobal net>]

Guy Harris wrote:
> ..."16-17" for the LAN capture and "17-18" for the WAN capture.
>
> Then enter a file name and click "Save"; that should save a file with only the two packets in question in it.
>
> Then browse to a directory into which you can save the file, 
>   
http://www.BogoLinux.net/LANFragment.cap
http://www.BogoLinux.net/WANFragment.cap
> OK, the header checksums are all valid (all four packets).  However, the packets in the WAN capture *might* have been 
> cut short by a snapshot length.  If you can't save the offending packets and send them to us, can you indicate what's 
> in the "Frame" portion of the packet detail pane for packet 17 in the WAN capture?  In particular, what are the 
> "Frame Length" and "Capture Length" values?
>   
I foolishly followed the WireShark manual, and followed it's 
instructions, for tcpdump, to capture the complete packets.  Except it 
doesn't.  LOL

Frame Length:  1514
Capture Length:  1500

Maybe the doc needs updating.  :)

Cheers.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe