Re: TCP reassembly when packet capture size limited

[Sake Blok <sake () euronet nl>]

On 16 nov 2010, at 19:17, Guy Harris wrote:

> On Nov 16, 2010, at 9:58 AM, Stephen Fisher wrote:
>
> > Should TCP reassembly be done when the packet size was limited during 
> > capture?
>
> Not unless we can do reassembly with "holes" in the result, which we currently can't do.  At least some other 
> dissectors check to make sure, when adding data to the reassembled packet, that all the data they're adding is 
> present.

IMHO reassembly is not very useful when packets have been truncated. So I would prevent TCP reassembly at the TCP level 
(actually I was under the impression the TCP dissector was doing that already, but I could be mistaken).


Sake

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe