Ethereal-users: Re: [Ethereal-users] (no subject)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Mon, 20 Feb 2006 10:37:02 -0800
Sake Blok wrote:

This is not a problem, this is normal IP-behaviour when a higher layer
protocol presents packets to the IP layer which can not be sent within
one packet. IP splits up the packet in multiple frames. In this proces
only the first frame has the UDP in t,

Presumably meaning "only one frame has the UDP header in it".

If you turn on the "Reassemble fragmented IP datagrams" option for the IP protocol (select Preferences from the Edit menu, open up the Protocols list in the Preferences dialog, select IP, and turn on that option; click "OK" to enable that option for the current Ethereal session, click "Save" and "OK" to make that the default option for all of your Ethereal sessions), Ethereal will attempt to reassemble IP packets that have been split up like that, and display the reassembled packet in the last fragment it sees.