Wireshark-users: [Wireshark-users] tcp reassembly
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Chun Chan <chun_chan@xxxxxxxxx>
Date: Wed, 16 Dec 2009 13:27:26 -0800 (PST)
Hi
I am writing a sniffer but I couldnt understand some things about tcp reassembly.
firstly I send a data via socket 5000 bytes. then tcpip stack split into three tcp packets. but this is not ip fragmentation. I think this is tcp segmentation.
but I can not understand when I will sniff this packet How can I defragment this packet?
I need to understand when finished 5000 bytes.
I will waiting your reply
thanks