This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What is not last buffer

0

What do it mean (not last buffer) is it something I need to worry about?

asked 12 Jun '14, 18:03

BigD's gravatar image

BigD
11112
accept rate: 0%


One Answer:

0

The Tabular Data Stream protocol has two layers - the "NETLIB" layer, which carries low-layer packets, and the TDS layer, which carries messages that might be contained in one NETLIB packet or that might be reassembled from multiple NETLIB packets.

"(Not last buffer)" indicates that the packet in question is a NETLIB packet that's part of a TDS message and that is not the last NETLIB packet for that TDS message. Wireshark will both reassemble TCP segments as necessary to make NETLIB packets and reassemble NETLIB packets to make TDS messages, and will dissect both.

answered 12 Jun '14, 19:42

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%