Ask Your Question

Can I join a SIP frame with the next Continuation frame?

asked 2019-06-28 12:23:46 +0000

jflarm gravatar image

I'm getting a SIP message broken into a SIP message with a the next frame described as "Continuation". Is there a way to join or merge those SIP frames with the next Continuation message that contains the end of the SIP message?

edit retag flag offensive close merge delete


If this is over TCP it means reassembly failed. Do you have out-of-order or duplicated packets? What version of Wireshark on what OS? In later versions there is an option to reasemble out-of-order packets.

Anders gravatar imageAnders ( 2019-06-28 13:00:07 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2019-06-28 14:33:03 +0000

SYN-bit gravatar image

Please check whether the following protocol preferences are enabled:

  • TCP: "Allow subdissector to reassemble TCP streams" -> should be enabled
  • SIP: "Reassemble SIP headers spanning multiple TCP segments" -> should be enabled
  • SIP: "Reassemble SIP bodies spanning multiple TCP segments" -> should be enabled if you want the SDP content to show up in one packet too.

You can find the protocol preferences by going to "Edit -> Preferences -> Protocols -> TCP / SIP" (Windows/Linux) or "Wireshark -> Preferences -> Protocols -> TCP / SIP" (Apple)

edit flag offensive delete link more


Thank you. TCP: "Allow subdissector to reassemble TCP streams" was not enabled.

jflarm gravatar imagejflarm ( 2019-07-02 14:53:34 +0000 )edit

Your welcome! Glad it got solved :-)

SYN-bit gravatar imageSYN-bit ( 2019-07-02 19:25:23 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-06-28 12:23:46 +0000

Seen: 212 times

Last updated: Jun 28 '19