UDP IPv6 packets remain fragmented. It supposed to be one large SIP message. Then, Turned OFF "Reassemble fragmented IPv6 datagrams" shows correct SIP message type, however SIP message is incomplete and shows "Unreassembled Packet".
Thank you "jaap"...we figured the issue... Here is more details... We had UDP message (SIP msg), rather large, it was segmented into three frames. We were applying tshark filter "frame contains <string>".. The "string" was in first two frame and not the third. After reassembly, we had incomplete msg (SIP malformed) since reassembly happened after selecting the frame.
To fix the issue...we needed to reassemble first and then apply the filter.
All we had to do was, instead of using "frame", we used "tcp contains.. or udp contains..." and we are seeing normal reassembled packet.
Thanks again.
The filter is not supposed to have any effect on reassembly - reassembly involves all frames, not just selected frames. If that's not the case, there's a bug in Wireshark.
Asked: 2018-07-12 19:32:46 +0000
Seen: 749 times
Last updated: Jul 13 '18
Without a look at the capture file this is impossible to answer. Please post it at a publicly accessible place.