 | 1 | initial version |
Is it possible to do memory-efficient packet reassembly, by simply looking back to a small number of previous pcap frames as needed to find valid protocol packets?
No.
All packet reassembly in Wireshark currently involves storing the contents of reassembled frames in memory.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
