Wireshark-users: [Wireshark-users] TCP reassemble question
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Bo Xu <xubo.leo@xxxxxxxxx>
Date: Sun, 16 May 2010 21:40:10 +0800
Hi guys ,
 
Wireshark can reassemble the tcp packets which is very cool feature. 
For example ,If  the reassemble option is disabled in the  preference,  assume #9 and #10 are carrying the whole piece information , there will be  these 2 prompt line in #9  :
 
Numer of bytes in flight :1460
Last frame of this PDU : 10
 
I would like to know how wireshark know these TCP segments are together  ?