Geek Answers Handbook

As wirehark marks some packages as the "tcp segment of the reassembled pdu"

I opened pcap in wirehark and it displays many packages as a "tcp segment of reassembled pdu". How can wirehark determine which tcp packets are segments of reassembled pdu? I cannot find any header field or anything else with which wirehark can detect this.

Any help would be greatly appreciated. THANKS!!!

+8
network-programming wireshark packet-capture tcpdump wireshark-dissector
source share
1 answer

The sequence number is a field that helps in reassembly. Say you have 1-300 bytes of data to send.

For example, they were divided into 3 segments of 100 each, that is, the first (1-100 bytes), the second (101-200) and the third (201-300). Now, even if they are received out of order, the sequence numbers will not change. Therefore, when reassembling data, you must know the initial order of the packets, and therefore wirehark can display the collected packets.

If the SYN flag is cleared (0), then this is the copied sequence number of the first byte of data of this packet for the current session.

TCP

Remember that this is different from ip fragmentation and reassembly. The IP header has fields to indicate if there are fragments, and if so, what is the fragment number of the current packet.

+11
source share

More articles:


All Articles