Wireshark mailing list archives
Re: Wireshark not reassembling UDP packet
From: Andre Kostur <akostur () incognito com>
Date: Tue, 24 Apr 2012 12:30:08 -0700
That did it. Disabling "Validate the IPv4 checksum if possible" caused Wireshark to reassemble the packet. Sake, did you still want the capture of the three packets? How would you like it delivered? Attached to a post to the list? (Will the list allow attachments? It's about 10kb over 6 packets. The AS-REQ which does get reassembled, and the AS-REP which does not.) On Tue, Apr 24, 2012 at 12:22, Michael Tuexen < Michael.Tuexen () lurchi franken de> wrote:
On Apr 24, 2012, at 8:36 PM, Sake Blok wrote:On 24 apr 2012, at 17:42, Andre Kostur wrote:Yep, Frame length and Capture length are 1514 bytes. UDP checksumvalidation is already disabled. Additional information, the capture was done on the same box as the packet transmitter. Doing the capture from a 3rd box, and wireshark is able to reassemble the packet.It should also work on the box itself. Are you able to post the capturefile so we can have a look at why it is failing? UDP doesn't do fragmentation and reassembly. So I guess you need IP level reassembly. One possibility is that the IP header checksum is not correct due to offloading. Does trying to disable the IP header checksum validation help? Best regards MichaelCheers, Sake___________________________________________________________________________Sent via: Wireshark-users mailing list <wireshark-users () wireshark org Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org ?subject=unsubscribe
-- *Andre Kostur* Senior Product Design Engineer *P:* 604-678-2864 *E:* akostur () incognito com *Toll-Free:* 1-800-877-1856 *F:* 604-678-2864 *VoIP:* sip:864 () sip incognito com [image: Incognito Software Inc.] <http://www.incognito.com> <http://www.incognito.com/company/events>
___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Wireshark not reassembling UDP packet Andre Kostur (Apr 23)
- Re: Wireshark not reassembling UDP packet Sake Blok (Apr 23)
- Re: Wireshark not reassembling UDP packet Andre Kostur (Apr 24)
- Re: Wireshark not reassembling UDP packet Sake Blok (Apr 24)
- Re: Wireshark not reassembling UDP packet Michael Tuexen (Apr 24)
- Re: Wireshark not reassembling UDP packet Andre Kostur (Apr 24)
- Re: Wireshark not reassembling UDP packet ronnie sahlberg (Apr 24)
- Re: Wireshark not reassembling UDP packet Kevin Cullimore (Apr 27)
- Re: Wireshark not reassembling UDP packet Guy Harris (Apr 27)
- Re: Wireshark not reassembling UDP packet Andre Kostur (Apr 24)
- Re: Wireshark not reassembling UDP packet Sake Blok (Apr 23)