On 16 nov 2010, at 19:17, Guy Harris wrote: > On Nov 16, 2010, at 9:58 AM, Stephen Fisher wrote: > >> Should TCP reassembly be done when the packet size was limited during >> capture? > > Not unless we can do reassembly with "holes" in the result, which we > currently can't do. At least some other dissectors check to make sure, when > adding data to the reassembled packet, that all the data they're adding is > present.
IMHO reassembly is not very useful when packets have been truncated. So I would prevent TCP reassembly at the TCP level (actually I was under the impression the TCP dissector was doing that already, but I could be mistaken). Sake ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
