 | 1 | initial version |
Is it possible to do memory-efficient packet reassembly, by simply looking back to a small number of previous pcap frames as needed to find valid protocol packets?
No.
All packet reassembly in Wireshark currently involves storing the contents of reassembled frames in memory.
