https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15712
--- Comment #3 from Guy Harris <g...@alum.mit.edu> ---
(In reply to Brian Cowan from comment #2)
> Resolved as user error. If a UDP packet gets fragmented, a port-specific
> filter will not capture all the packets since only the first contains the
> port number. UDP != TCP where packet headers are concerned.
If you happen to have TCP segments too big to fit in a single link-layer frame,
so that the segment is put into multiple IP fragments, the same thing will
happen as with fragmented UDP packets.
The only difference is that TCP has its own segmentation/reassembly mechanism,
so if you want to send a 4KB message over TCP, and not all the hosts in the
path support 4K+{TCP header}+{IP header} packets, you don't have to send it as
a single TCP segment and have it fragmented at the IP layer, you can send it as
multiple TCP segments, each of which fits in a link-layer packet on all hops of
the route (especially if path MTU discovery is used, so you know what the
smallest MTU is), whereas UDP doesn't have a segmentation/ressembly mechanism,
so you *have* to rely on IP fragmentation if your message won't fit in a single
link-layer packet.
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
