1
1
Is there a filter in Wireshark to select all the "TCP segment of a reassembled PDU" packet?
Sean Nguyen
Posted 2013-08-17T09:12:57.560
Reputation: 635
How to select all the "TCP segment of a reassembled PDU" frame in Wireshark?
Answers
0
Enter in the Filter box: tcp.reassembled_in
This works to filter packets that have already been read, but it's not so good at handling new packets during a live capture. I think that's because the "reassembled" attribute is not knowable until all the packets participating in the reassembly have arrived (it's a forward pointer to the final packet in the group). By the time the reassembly is done, it's too late to change the filter's decision not to display the earlier packets.
it doesn't work. Which wireshark version that you are using? I am using the latest 1.10.1. – Sean Nguyen – 2013-08-18T14:31:30.657
Worked for me in that version, but I only checked it after the capture had stopped. I guess it doesn't work on the fly. – None – 2013-08-18T15:13:14.803