Can I join a SIP frame with the next Continuation frame?

asked 2019-06-28 12:23:46 +0000

jflarm
3 ●1

I'm getting a SIP message broken into a SIP message with a the next frame described as "Continuation". Is there a way to join or merge those SIP frames with the next Continuation message that contains the end of the SIP message?

Comments

If this is over TCP it means reassembly failed. Do you have out-of-order or duplicated packets? What version of Wireshark on what OS? In later versions there is an option to reasemble out-of-order packets.

Anders ( 2019-06-28 13:00:07 +0000 )edit

add a comment

answered 2019-06-28 14:33:03 +0000

SYN-bit

18344 ●9 ●301 ●255 https://SYN-b.it

Please check whether the following protocol preferences are enabled:

TCP: "Allow subdissector to reassemble TCP streams" -> should be enabled
SIP: "Reassemble SIP headers spanning multiple TCP segments" -> should be enabled
SIP: "Reassemble SIP bodies spanning multiple TCP segments" -> should be enabled if you want the SDP content to show up in one packet too.

You can find the protocol preferences by going to "Edit -> Preferences -> Protocols -> TCP / SIP" (Windows/Linux) or "Wireshark -> Preferences -> Protocols -> TCP / SIP" (Apple)

edit flag offensive delete link

Comments

Thank you. TCP: "Allow subdissector to reassemble TCP streams" was not enabled.

jflarm ( 2019-07-02 14:53:34 +0000 )edit

Your welcome! Glad it got solved :-)

SYN-bit ( 2019-07-02 19:25:23 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Can I join a SIP frame with the next Continuation frame?

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Can I join a SIP frame with the next Continuation frame? edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Can I join a SIP frame with the next Continuation frame?