|
|
|
|
|
by johnnny
1229 days ago
|
|
TCP tries really hard to avoid fragmentation, by setting the DF flag and reducing the MSS when it sees a PTB error. Of course that sometimes fails, so if you still have TCP fragmented segments, the next best thing is to filter by source/destination address, saving to a PCAP file, then run tshark on that file with the "-2" flag which does packet reassembly. (I don't know if tshark can be made to do on-the-fly reassembly, that would require keeping a buffer of un-reassembled fragments until the rest of the packets are seen.) |
|