how does wireshark identify two or three packets that belong the same tcp segment

bianmingkai
1 ●1 ●3 ●3

Hi how does wireshark identify two or three packets that belong the same tcp segment . thanks

2 Answers

Sort by » oldest newest most voted

13730 ●685 ●115

It follows this reassembly process, thereby constructing the original TCP packet, to be handed of to the TCP dissector.

See also RFC 791, in particular the information and discussions around fragmentation.

cmaynard ( 2018-06-05 20:30:03 +0000 )edit

Guy Harris
19890 ●3 ●634 ●207

See my answer to the same question, asked as a comment on the answer to this question.

Please start posting anonymously - your entry will be published after you log in or create a new account.

1 follower

Asked: 2018-06-05 15:21:03 +0000

Seen: 224 times

Last updated: Jun 05 '18

Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.