Xu nanxuan wrote:
When downloading a big file from the server, initially the info in the
list column of wireshark sound reasonable. However, as the downloading
process ends(using totally about 60 secs), the time stamp in wireshark
console just passed 30 secs. And in the next 60-30=30 secs, only "TCP
segment of a reassembled PDU" is shown in the list column, while the
detail info of each these packets are still reasonable.
Then 2 questions:
1.what does "TCP segment of a reassembled PDU" mean?
It means that Wireshark thinks the packet in question contains part of a
packet (PDU - "Protocol Data Unit") for a protocol that runs on top of TCP.
If the reassembly is successful, the TCP segment containing the last
part of the packet will show the packet.
The reassembly might fail if some TCP segments are missing.
2.If i do not want to see "TCP segment of a reassembled PDU", how can i
view the correct info just as those in the first "30 secs"?
Turn off TCP reassembly in the preferences for TCP.