> (this will be fun. i am not aware of any of the other analyzers being
> capable of reassembly.
I think I saw something in the documentation for a Sniffer (classic
DOS-based) that I interpreted as meaning it did reassembly, but I
haven't seen it in action.
The SMS 2.0 version of Network Monitor has a way of "recombining
frames":
About Coalesced Frames
The Protocol Coalesce Tool is an expert that merges data from
frames that are part of the same transaction. A portion of data
sent from one computer can be split into several smaller
fragments to be sent over the wire and reassembled at the
destination. The Protocol Coalesce Tool provides a way to
recombine frames.
When the Protocol Coalesce Tool encounters frames that contain
fragments from the same transaction, it recombines these
fragments into a single frame. The new coalesced frame contains
header information - such as which frames from the original
capture file were used to create the coalesced frame - and the
combined data of the frame fragments.
The coalesced frame is placed in a new coalesced capture file,
or if the expert was run from the right-click menu, the
coalesced frame is inserted into the original capture file.
but either I didn't use it correctly, or it doesn't do the sort of
reassembly we do (I couldn't get it to, for example, handle SMB requests
that required multiple TCP segments, but perhaps I tried it on a file
where not all of the frame data was saved).