 | 1 | initial version |
Thank you "jaap"...we figured the issue... Here is more details... We had UDP message (SIP msg), rather large, it was segmented into three frames. We were applying tshark filter "frame contains <string>".. The "string" was in first two frame and not the third. After reassembly, we had incomplete msg (SIP malformed) since reassembly happened after selecting the frame.
To fix the issue...we needed to reassemble first and then apply the filter.
All we had to do was, instead of using "frame", we used "tcp contains.. or udp contains..." and we are seeing normal reassembled packet.
Thanks again.
