[didier <dgautheron@xxxxxxxx>]

Devin Heitmueller wrote:
> Shouldn't this be based in part on the result of the TCP checksum?  If
> the TCP checksum validation fails, the peer is going to discard the
> packet and wait for a retransmit.  In this case, we should probably be
> dissecting the second packet, not the first.  There is little value in
> attempting to dissect a packet that fails the TCP checksum, as it could
> contain complete garbage.
Ethereal already does it.

Here the pb is :
we have a tcp segment, in frame 709, this segment is ACKed and fully 
decoded as NCP, 10 mn later a keep alive is sent

F 709    xx xx xx ff 00
F 2828                   ff
After come a new packet
F  7050 yy yy yy yy yy
Now ethereal wrongly desegments F 2828 + F 7050 as
ff yy yy yy yy yy yy yy

By design F2828 can't be pushed back in F 709, and in this case it 
shouldn't anyway.

Didier