how does wireshark identify two or three packets that belong the same tcp segment

First time here? Check out the FAQ!

bianmingkai
1 ●1 ●3 ●3

Hi how does wireshark identify two or three packets that belong the same tcp segment . thanks

2 Answers

Sort by » oldest newest most voted

13782 ●716 ●115

It follows this reassembly process, thereby constructing the original TCP packet, to be handed of to the TCP dissector.

See also RFC 791, in particular the information and discussions around fragmentation.

cmaynard ( Jun 5 '18 )

Guy Harris
19905 ●3 ●667 ●207

See my answer to the same question, asked as a comment on the answer to this question.

Please start posting anonymously - your entry will be published after you log in or create a new account.

1 follower

Asked: Jun 5 '18

Seen: 263 times

Last updated: Jun 05 '18