Ethereal-users: [Ethereal-users] Re: [tcpdump-workers] UDP Fragments

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Hannes Gredler <hannes@xxxxxxxxxxx>
Date: Sat, 11 Mar 2006 17:13:27 +0100
luis,

see the answer to the same questions answered a few weeks before.

bottomline is: tcpdump does not perform fragment reassembly and
there is no way to catch the fragments bases on port numbers.

/hannes

Luis Del Pino wrote:

Hi, I'm Luis del Pino, What filter could I use to capture UDP datagrams and
its fragments?

I have this filter "dst 192.168.0.120 and (udp dst port 10005 or udp dst
port 10006 or udp dst port 10007)" but it doesn't capture the fragments. I
only want capture its fragments and not capture all IP datagrams. i have
thought to use the fields, flag and fragment offset in the IP  datagram.

Thanks
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.