https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3049
Guy Harris <guy@xxxxxxxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|In consistency in dissecting|Inconsistency in dissecting
|IP |IP
--- Comment #2 from Guy Harris <guy@xxxxxxxxxxxx> 2008-11-10 10:55:42 PDT ---
When I read that capture file with a fairly recent recent top-of-SVN-tree
Wireshark, the first two packets are not shown as IP fragments because they're
not IP fragments - the "More fragments" flag is not set and the fragment offset
is 0. The third packet is shown as an IP fragment because it *is* an IP
fragment - the "More fragments" flag is set. The fourth packet is the second
fragment of that fragmented IP datagram - the "More fragments" flag is not set,
and the fragment offset is 1480, which is the length of the IP payload (not the
full IP packet) of the third packet.
So, at least for those packets, all of them are being correctly identified.
Now, some packets at the end are identified as "PPP Fragment", but that has
nothing whatsoever to do with IP fragments. Note that we do *NOT* fully handle
the CDMA2000 A10 unstructured byte stream data type; we do not, for example,
reassemble PPP frames split across multiple lower-level packets.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.