Ethereal-users: Re: [Ethereal-users] unreassembled fragmented

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Fri, 9 Jul 2004 06:06:10 +0200
Hansang Bae wrote:
> On 02:29 PM 7/8/2004, Colao, Anthony wrote:
> >Can Anyone tell me what an unreassembled fragmented packet is?  What it is caused by?
>
>
> If a packet cannot traverse a link because of MTU mismatch, then the router must fragment the IP packet into two or
more parts.  This assumes the client is not using PMTU-D to find the proper MTU size and is not setting the DF bit.
>
> If you fragment the packet and lose a part of the piece, you can get these types of issues.
>

Please also note that by default Ethereal will not reassemble fragmented IP-packets.
You will need to change the preference settings for IP to reassemble fragmented IP-packets.

Edit/Preferences.../Protocols/IP/Reassemble fragmented IP datagrams
Check that check box, and press Save+Apply+OK

You might also want to change the setting to allow TCP subdissectors to desegment segemented TCP streams.
Edit/Preferences.../Protocols/TCP/Allow subdissector to desegment TCP streams