I am aware of what this feature does but i would like to know more on when to enable this feature and when to disable it.
When i enable the tcp reassembly i am not seeing any HTTP 200 OK Responses but seeing tcp segment of reassembled pdu.
When i disable the tcp reassembly i am seeing HTTP 200 OK response.
As i told earlier i want to know more on when to enable and when to disable this option.
asked 08 Apr '13, 12:14
edited 08 Apr '13, 13:11
You should see the HTTP 200 OK in the info column either way, but with reassembly enabled it is displayed in the last packet of the content, not the first (where it is in reality, if you check the payload)
My rule of thumb: disable TCP reassembly by default. Enable if you need to reconstruct payload content, e.g. for forensic analysis.
answered 08 Apr '13, 12:17