[Guy Harris <gharris@xxxxxxxxx>]

On Fri, Jan 10, 2003 at 05:37:24PM -0000, mike.thackray@xxxxxxxxx wrote:
> (I assume this is because the
> display filter created by Ethereal uses port numbers which are not
> present in the second "fragmented IP protocol" fragments.

Yes, that's why.

> Is there any way of following the entire stream,

Select "Preferences" from the "Edit" menu, click on the "[+]" next to
"Protocols" to open up the list of protocols, select "IP" from that
list, turn on "Reassemble fragmented IP datagrams", click "Save" if you
want Ethereal and Tethereal to *always* reassemble fragmented IP
datagrams by default (i.e., if you do that, the next time you run
Ethereal you won't have to do all this), and then click "OK".

This will cause Ethereal to reassemble fragmented IP datagrams, so that
it will see the entire GTP fragment and thus the entire IP datagram
inside the GTP packet and thus the entire TCP segment inside the IP
datagram.