[Bo Xu <xubo.leo@xxxxxxxxx>]

Hi guys ,

 

Wireshark can reassemble the tcp packets which is very cool feature. 

For example ,If  the reassemble option is disabled in the  preference,  assume #9 and #10 are carrying the whole piece information , there will be  these 2 prompt line in #9  :

 

Numer of bytes in flight :1460
Last frame of this PDU : 10

 

I would like to know how wireshark know these TCP segments are together  ?