how wireshark marks some packets as "tcp segment of a reassembled pdu"

network-programming wireshark packet-capture tcpdump wireshark-dissector
mezda picture mezda · Oct 11, 2012 · Viewed 30.6k times · Source

I opened a pcap in wireshark and it displays a lot of packets as "tcp segment of a reassembled pdu". How wireshark is able to determine which tcp packets are segments of a reassembled pdu ? I am not able to find any header field or anything else by which wireshark can determine this.

Any help will be greatly appreciated. THANKS !!!

Answer

fkl picture fkl · Oct 11, 2012

Sequence number is the field which helps in reassembly. Say you have data bytes 1-300 to send.

For instance they were divided into 3 segments of size 100 each i.e. first (1-100 byte number), second (101 - 200) and third (201-300). Now even if they are received out of order, sequence numbers won't change. So when reassembling data, you would know the original order of packets and hence wireshark can display the assembled packets.

If the SYN flag is clear (0), then this is the accumulated sequence number of the first data byte of this packet for the current session.

TCP

Remember, this is different from ip fragmentation and reassembly. IP header has fields to specify if there are fragments and if so, what is the fragment number of current packet.

Related questions

frame contains "\x03\x00\x0e\xa8" display filter in wireshark displays packets not containing these bytes

i used the following filter in wireshark to find the packets containing these bytes : frame contains "\x03\x00\x0e\xa8" but when i see the result of this filter, it displays more than 1k packets which don't even contain …

Read More
How to copy hex data of captured packet form wireshark

here is the example this is the captured packet data 00000000 00 6e 0b 00 .n.. 00000004 4d 5a e8 00 00 00 00 5b 52 45 55 89 e5 81 c3 81 MZ.....[ REU..... 00000014 12 00 00 ff d3 89 c3 57 68 04 00 00 00 50 ff d0 .......W h....P.. 00000024 68 f0 b5 a2 56 68 05 00 00 00 50 ff d3 00 00 00 h...Vh.. ..P..... 00000034 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 ........ ........ 00000044 0e 1f …

Read More
How do I pump traffic using tcpreplay at 100 MBps, 500 MBps and 1Gbps speeds?

I used the -R and -K option but it doesnt seem to be working as I captured the pumped traffic using tcpdump and the number of packets that I see there dont seem to match the number of packets that …

Read More