Re: [Wireshark-dev] Some more question on TCP desegmentation

Kaul skrev 2010-12-01 07:40: On Wed, Dec 1, 2010 at 8:22 AM, Andreas > wrote: Am 30.11.2010 13:05, schrieb Kaul: > 1. If only some of the segments (say, first 50 out of 70), will I get that > partial PDU, or just the original TVB (the first packe

Re: [Wireshark-dev] Some more question on TCP desegmentation

On Wed, Dec 1, 2010 at 8:22 AM, Andreas wrote: > Am 30.11.2010 13:05, schrieb Kaul: > > 1. If only some of the segments (say, first 50 out of 70), will I get > that > > partial PDU, or just the original TVB (the first packet, essentially)? > > Don't know what you ask for. But when you call tcp_di

Re: [Wireshark-dev] Some more question on TCP desegmentation

Am 30.11.2010 13:05, schrieb Kaul: > 1. If only some of the segments (say, first 50 out of 70), will I get that > partial PDU, or just the original TVB (the first packet, essentially)? Don't know what you ask for. But when you call tcp_dissect_pdus(), you pdu_dissect function will get a fresh new

[Wireshark-dev] Some more question on TCP desegmentation

1. If only some of the segments (say, first 50 out of 70), will I get that partial PDU, or just the original TVB (the first packet, essentially)? 2. I'm fighting hard with LDAP not being de-segmented properly, only to find out that in tcp_dissect_pdus(), pinfo->can_desgement is false. What could be