Ethereal-dev: Re: [Ethereal-dev] Re: Should "dissect_tpkt_encap()" check only its "desegment"

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Sat, 24 Sep 2005 01:57:09 +0200
ronnie sahlberg wrote:


There are two problems with having TCP reassembly enabled by default.

1, Many work with large captures.   300MB-1GB capture files are not unusual.
You do NOT want to enable reassembly on a CIFS, NFS or iSCSI capture that big!

2, If there are packets missing from the capture (because the capture
device cant keep up with the line rate) then
the higher layer PDUs wont be dissected at all.
(when reassembly is enabled, the next layer dissector will ONLY be
called IF the entire PDU has been successfully reassembled).


But then again,   most people probably only work with very small
captures   taken on very slow links   so the problems above would
never occur for them.
Hmmm, I'm using a very fast link (1GB Ethernet) but only the traffic is low ;-)
There's no doubt about, that doing reassembly on large capture files can be a pity for several reasons. 

But I would doubt that most users are using 300MB-1GB files :-)
Again, the Preferences should be the best chosen for the "usual Ethereal novice" (whoever that might be). I have real doubts that the novice Ethereal user will start with 300MB capture files :-)
The advanced users (like you and me) can tweak the Preferences to whatever they want. 

Regards, ULFL