Yes. I meant fram 8,9,10
I think this HTTP request is completed. no more data is needed in subsequent frame. We can see 0x0d0a0d0a at the end of frame 10.
I am also wondering why web server reset the connection. but it should not do that no matter there some more frames to be recieve or not. a possible reason is that the IIS application pool crushed after it recieved the HTTP request (frame 8-10).
What I would like to understand is why Wireshark did not reassamble frame 8-10. What did it wait for?
On 12/16/06, Stephen Fisher <stephentfisher@xxxxxxxxx> wrote:
On Fri, Dec 15, 2006 at 10:09:26PM +0800, Xiaoguang Liu wrote:
> in the attachment, frame 7,8,9 shoud be a single HTTP request. Why
> wireshark did not reassamble them? Test on Version 0.99.5-SVN-20139
> (SVN Rev 20139), windows xp sp2. I do eanble all reasamble HTTP .....
> options.
I believe you meant frames 8, 9, 10? They are being reassembled as you
can see from [TCP segment of a reassembled PDU] in the info column.
However, as you stated the final reassembled HTTP packet never shows up.
My guess would be that more data is expected before it finishes the
reassembly, but instead the server resets the connection (RST in the
final frame of the capture). Can you reproduce this problem again?
Steve
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users