Ethereal-dev: [Ethereal-dev] Re: [Ethereal-users] Saving reassembled IP packets?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 14 Apr 2004 10:54:38 -0700
On Tue, Apr 13, 2004 at 05:49:22PM +0200, Biot Olivier wrote:
> And to complicate things even more, there will probably be packets that do
> not participate in the reassembly as such (TCP ACK, TCP SYN, ...) but which
> may contain important information for the dissection.

...which is even an issue if there's no reassembly being done - there's
no guarantee in general that, if you save a file with a subset of the
packets in the capture, the remaining packets will be dissected the same
way they were in the original capture, as state information obtained by
dissecting the unsaved packets might affect the way the other packets
are dissected.