8

I opened a pcap in wireshark and it displays a lot of packets as "tcp segment of a reassembled pdu". How wireshark is able to determine which tcp packets are segments of a reassembled pdu ? I am not able to find any header field or anything else by which wireshark can determine this.

Any help will be greatly appreciated. THANKS !!!

mezda
  • 3,537
  • 6
  • 30
  • 37
  • Although the question does not involve code, i can bet every one doing network programming runs into this kind of questions WHEN coding. The are crafting / processing packets and don't understand how wireshark is showing what it does. So i answered any way. It is important to note that a person who is only viewing packets in wireshark and NOT PROGRAMMING code to process that would probably not ask about it – fkl Oct 21 '14 at 18:35
  • Yeah, I agree with you ! Stack over flow 逼格太高了，一大波逼哥在争先恐后的close – sooglejay Sep 21 '16 at 15:24

1 Answers1

12

Sequence number is the field which helps in reassembly. Say you have data bytes 1-300 to send.

For instance they were divided into 3 segments of size 100 each i.e. first (1-100 byte number), second (101 - 200) and third (201-300). Now even if they are received out of order, sequence numbers won't change. So when reassembling data, you would know the original order of packets and hence wireshark can display the assembled packets.

If the SYN flag is clear (0), then this is the accumulated sequence number of the first data byte of this packet for the current session.

TCP

Remember, this is different from ip fragmentation and reassembly. IP header has fields to specify if there are fragments and if so, what is the fragment number of current packet.

fkl
  • 5,412
  • 4
  • 28
  • 68