Wireshark-users: Re: [Wireshark-users] Identification of Fragmented UDP Packets

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Eddie <stunnel@xxxxxxxxxxxxx>
Date: Thu, 21 Jan 2010 17:52:06 -0800

Guy Harris wrote:

There isn't anything obvious that should cause Wireshark not to attempt reassembly, but I didn't check the IP header checksum - is Wireshark reporting IP checksum errors on any of the WAN packets?

Nope:
Header checksum: 0xa746 [correct]
Header checksum: 0xc971 [correct]

Can you save just the two offending fragments from the WAN capture to a file?  If so, when you read the file in, does it reassemble the fragments?  If not, could you send us that capture, along with the version information from Wireshark?

Not sure what you mean by this.  Can you explain a little more please.
I've also uploaded a couple of screen shots, which hopefully reinforce my descriptions of what I'm seeing. On the LAN, it's packets 16 and 17. The WAN is 17 and 18. 

http://www.BogoLinux.net/LANFragments.png
http://www.BogoLinux.net/WANFragments.png

I'm running WireShark:  Version 1.2.5 (SVN Rev 31296)

Cheers.