Disable TCP reassembly on CLI tshark

Question

I would like to get the http.time as the time between the first packet of the request and the first packet of the response. On this question they say it is possible to be done with wireshark by disabling TCP reassembly , but, how can I do it with CLI tshark, there is no information about this on the manpage.

Thanks in advance

Accepted Answer

0	I just found it `-o tcp.desegment_tcp_streams:false` permanent link answered 10 Jul '16, 15:05 carlosvega 26●1●1●2 accept rate: 100%

Disable TCP reassembly on CLI tshark

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions