This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What do it mean (not last buffer) is it something I need to worry about?

asked 12 Jun '14, 18:03

BigD's gravatar image

BigD
11112
accept rate: 0%


The Tabular Data Stream protocol has two layers - the "NETLIB" layer, which carries low-layer packets, and the TDS layer, which carries messages that might be contained in one NETLIB packet or that might be reassembled from multiple NETLIB packets.

"(Not last buffer)" indicates that the packet in question is a NETLIB packet that's part of a TDS message and that is not the last NETLIB packet for that TDS message. Wireshark will both reassemble TCP segments as necessary to make NETLIB packets and reassemble NETLIB packets to make TDS messages, and will dissect both.

permanent link

answered 12 Jun '14, 19:42

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×14
×1

question asked: 12 Jun '14, 18:03

question was seen: 5,502 times

last updated: 12 Jun '14, 19:42

p​o​w​e​r​e​d by O​S​Q​A