how does wireshark knows when the file download is completed
Hi,
How does wireshark knows when the file download is completed ?
After downloading a file, we see the usual "FIN - FIN/ACK - FIN/ACK - FIN" packets.
The packet just before have the last part of the data. In this case, a jpg file.
For that packet, below the TCP layer, wireshark kindly reassembles the TCP segments, i.e. "10 Reassembled TCP Segments ...".
And below the "10 Reassembled..." line, we see the assembled HTTP and JPEG layers.
But what makes wireshark knows that this packet contains the last part of the jpg file ?