Ask Your Question

Revision history [back]

Not really. When the preference is set to enable, the TCP dissector correctly reassembles the stream such that retransmissions are dropped and sub-dissectors get a "clean" stream.

When the preference is set to disable, then all TCP payloads are handed to the sub-dissectors and they must handle the retransmissions.

If you (and your users) are interested in the application level, then what goes on at the TCP level isn't interesting and allowing the TCP dissector to reassemble the stream correctly is much more productive. The application actually consuming the protocol won't see the retransmission, so in that respect the sub dissector will show what the application receives.