On Apr 22, 2014, at 11:39 AM, John Dill <John.Dill@xxxxxxxxxxxxxxxxx> wrote:
> So my question is, what is the correct behavior to implement?
The behavior you're implementing.
> Should I not have a desegment option?
Make it an option only if it's useful not to desegment.
If you want to prevent "Malformed packet" errors on unreassembled packets, the best way to do that is to
1) wait for me to finish making tcp_dissect_pdus() flag unreassembled packets as such, so that they're marked as "unreassembled" rather than "malformed" if fields are missing (making changes
and then
2) use only Wireshark 1.11.x and later (as my changes may be too large to put into 1.10.x or earlier).