Wireshark-users: [Wireshark-users] tshark and reassembly

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "KATWALA, KALPESH (ATTLABS)" <kk891r@xxxxxxx>
Date: Tue, 1 Dec 2009 13:37:36 -0500
All,
 
I am using tshark (version 1.0.8) to do a live capture of SIP and DIAMETER messages.
 
For some of the DIAMETER messages, I have multiple segmented TCP messages.  When I open captured PCAP file via Wireshark, Wireshark re-assembles these segmented TCP messages.  However, when I use tshark to do futher filtering, it doesn't re-assemble these messages and it looses these packets.
 
How do I get the tshark to assemble these packets?
 
Kalpesh.