Wireshark · Wireshark-users: Re: [Wireshark-users] what does "TCP segment of a reassembled PDU" mean?

[Guy Harris <guy@xxxxxxxxxxxx>]

Xu nanxuan wrote:
> When downloading a big file from the server, initially the info in the 
> list column of wireshark sound reasonable. However, as the downloading 
> process ends(using totally about 60 secs), the time stamp in wireshark 
> console just passed 30 secs. And in the next 60-30=30 secs, only "TCP 
> segment of a reassembled PDU" is shown in the list column, while the 
> detail info of each these packets are still reasonable.
>  
> Then 2 questions:
> 1.what does "TCP segment of a reassembled PDU" mean?

It means that Wireshark thinks the packet in question contains part of a 
packet (PDU - "Protocol Data Unit") for a protocol that runs on top of TCP.

If the reassembly is successful, the TCP segment containing the last 
part of the packet will show the packet.

The reassembly might fail if some TCP segments are missing.

> 2.If i do not want to see "TCP segment of a reassembled PDU", how can i 
> view the correct info just as those in the first "30 secs"?

Turn off TCP reassembly in the preferences for TCP.