Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

When you see a lot of "Ignored unknown record" messages, it usually means reassembly is failing at some point. Can you make sure you have set the following protocol preferences:

  • Make sure checksum checking is off at the ethernet, IP and TCP layer (as a checksum error will stop reassembly)
  • Make sure "Allow subdissectors to reassemble TCP streams" is enabled in the TCP protocol preferences
  • Make sure "Reassemble TLS records spanning multiple TCP segment" is enabled in the TLS protocol preferences
  • Make sure "Reassemble TLS application data spanning multiple TCP records" is enabled in the TLS protocol preferences