This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am aware of what this feature does but i would like to know more on when to enable this feature and when to disable it.

When i enable the tcp reassembly i am not seeing any HTTP 200 OK Responses but seeing tcp segment of reassembled pdu.

When i disable the tcp reassembly i am seeing HTTP 200 OK response.

As i told earlier i want to know more on when to enable and when to disable this option.

Thanks,

asked 08 Apr '13, 12:14

krishnayeddula's gravatar image

krishnayeddula
629354148
accept rate: 6%

edited 08 Apr '13, 13:11

Jasper's gravatar image

Jasper ♦♦
23.8k551284


You should see the HTTP 200 OK in the info column either way, but with reassembly enabled it is displayed in the last packet of the content, not the first (where it is in reality, if you check the payload)

My rule of thumb: disable TCP reassembly by default. Enable if you need to reconstruct payload content, e.g. for forensic analysis.

permanent link

answered 08 Apr '13, 12:17

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thanks.As you mentioned i am seeing http 200 Ok in both cases.In case of tcp reassembly disabled the 200 OK packet size is 1502 but when it is enabled the 200 OK packet size is 712 bytes. Can you please clear me the reason behind this?

(08 Apr '13, 12:28) krishnayeddula
2

That's because the packet size is the size of the current packet, not of the reassembled higher layer PDU. And the last segment of a reassembled PDU is usually smaller than the others...

(08 Apr '13, 12:42) SYN-bit ♦♦

Got it.Thanks

(08 Apr '13, 12:45) krishnayeddula
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×18
×11

question asked: 08 Apr '13, 12:14

question was seen: 6,459 times

last updated: 08 Apr '13, 13:11

p​o​w​e​r​e​d by O​S​Q​A