Wireshark-bugs: [Wireshark-bugs] [Bug 4905] VoIP Calls Prepare Filter unreliable
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sat, 9 Oct 2010 08:22:37 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4905

--- Comment #10 from Jaap Keuter <jaap.keuter@xxxxxxxxx> 2010-10-09 17:22:30 CEST ---
(In reply to comment #8)
> Additionally, the generated filter doesn't take into account reassembled IP
> fragments. Typically, if a long UDP packet takes 3 IP frames N, N+1, N+2, only
> the (N+2) will appear in the (or frame.number==...) list.

This is inevitable in the current reassembly implementation. If you try to
construct a data link layer filter from application layer messages, you're
isolated from the reassembly at the lower layer. Therefore there is no way to
know which packets were used in the reassembly, thus can't be added to the
filter.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.