Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Is it possible to do memory-efficient packet reassembly, by simply looking back to a small number of previous pcap frames as needed to find valid protocol packets?


All packet reassembly in Wireshark currently involves storing the contents of reassembled frames in memory.