Wireshark · Wireshark-users: Re: [Wireshark-users] asking a question

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

The protocol stack is called TCP/IP, that is Transport Control Protocol over 
Internet Protocol. When the IP protocol layer cannot carry the TCP layer PDU as 
a whole, it fragments it, and sends the TCP segments one by one. These are the 
packets you see.
Wireshark is able to tell that these are TCP segments and can do its best to 
reassemble the original TCP PDU for you. The result will then be presented with 
the last TCP segment coming in.

This is basic TCP/IP stuff. Read your Stevens, or Wikipedia for that matter.

Thanks,
Jaap

chendahong@xxxxxxxxxxxxxxxx wrote:
> When I used the wireshark to capture ip packets, the wireshark considered
> some packets as "TCP segment of a reassembled PDU".
>
> Please explain the means of "TCP segment of a reassembled PDU" to me.
>
> thanks.