Wireshark-users: Re: [Wireshark-users] Configure coloring rule for [TCP segment of a reassembled
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: sean bzd <seanbzd@xxxxxxxxx>
Date: Thu, 9 Apr 2009 16:58:06 -0400
Sake,
Thanks a lot. That helped. Like you said, this doesn't work for the
first fragment of a reassembled PDU; but thats OK for now. Looking
through the archives, someone suggested a fix for the this first
fragment problem:
http://www.wireshark.org/lists/wireshark-bugs/200902/msg00260.html

>On Wed, Apr 08, 2009 at 06:35:57PM -0400, sean bzd wrote:
>>    I'm getting a lot of [TCP segment of a reassembled PDU] messages. These
>>    are expected and I understand why this is happening. I'm wondering if
>>    there is a way to identify them and configure a coloring rule. Any ideas?
>>    Appreciate any help.

>You can use the filter "tcp.reassembled_in" in your coloring rule (see
>the users guide on how to add a coloring rule). Unfortunately however,
>there seems to be a bug in the tcp-dissecter that does not add this
>field to the first fragment of a reassembled PDU.

>(I will have a look at the tcp-dissector to see whether it can be easily
fixed)

>Cheers,
    >Sake