Ask Your Question

UDP IPv6 packets remain fragmented.

asked 2018-07-12 19:32:46 +0000

shahkal gravatar image

UDP IPv6 packets remain fragmented. It supposed to be one large SIP message. Then, Turned OFF "Reassemble fragmented IPv6 datagrams" shows correct SIP message type, however SIP message is incomplete and shows "Unreassembled Packet".

edit retag flag offensive close merge delete


Without a look at the capture file this is impossible to answer. Please post it at a publicly accessible place.

Jaap gravatar imageJaap ( 2018-07-12 20:10:32 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2018-07-13 18:56:25 +0000

shahkal gravatar image

Thank you "jaap"...we figured the issue... Here is more details... We had UDP message (SIP msg), rather large, it was segmented into three frames. We were applying tshark filter "frame contains <string>".. The "string" was in first two frame and not the third. After reassembly, we had incomplete msg (SIP malformed) since reassembly happened after selecting the frame.

To fix the issue...we needed to reassemble first and then apply the filter.

All we had to do was, instead of using "frame", we used "tcp contains.. or udp contains..." and we are seeing normal reassembled packet.

Thanks again.

edit flag offensive delete link more


The filter is not supposed to have any effect on reassembly - reassembly involves all frames, not just selected frames. If that's not the case, there's a bug in Wireshark.

Guy Harris gravatar imageGuy Harris ( 2018-07-14 00:40:13 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-07-12 19:32:46 +0000

Seen: 512 times

Last updated: Jul 13 '18