Wireshark-users: Re: [Wireshark-users] Disabling TCP reassembly does not work

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 18 Feb 2009 19:46:47 -0800

On Feb 18, 2009, at 4:24 PM, Bill Meier wrote:

For some possibilities see the EMail thread starting with:

http://www.wireshark.org/lists/wireshark-users/200806/msg00245.html

Shorter version: perhaps your networking card is doing some TCP segmentation - and desegmentation - offloading, and what it hands to the local networking stack are "packets" that are actually made up of multiple link-layer packets being reassembled by the networking adapter.

That thread might indicate how to turn segmentation/desegmentation offloading off on Windows.