Ask Your Question

Revision history [back]

No, that is not an issue in general. It just says that the transferred data is too large for one packet. Therefor it is spreaded over more packets. Wireshark can now reassemble that data for you. So that you are able to analyze the application content. If you want to analyze the Layer 1-4 content then it is sometimes better to disable the reassembly. You can do this by right clicking on the application header (e.g. HTTP or TLS) and then under Protocol Preferences you find entries which are called "Reassembly..." If you deactivate them, the message "TCP segment of a reassembled PDU" is gone.

So in short:

  • Application issue -> Enable
  • Reassembly Network Issue -> Disable Reassembly