#杂问#wireshark的reassemble tcp含义

Wireshark supports reassembly of PDUs spanning multiple TCP segments for a large number of protocolsimplemented on top of TCP. These protocols include, but are not limited to,iSCSI, HTTP, DNS, Kerberos, CIFS, ONC-RPC etc. All in all probably something like 20 different protocols.

TCP之上的应用层交给TCP的数据超过一个TCP segment的范围，会将应用层数据放入多个TCP segments中。

wireshark可自动对TCP segments进行reassemble。但依赖于网络包的校验if you capture the entire packet and if all the checksums for that packet are valid

对特定协议是否启用reassemble可以单独设置。

wireshark的官方wiki：http://wiki.wireshark.org/TCP_Reassembly

This is merely a result of the TCP Protocol preferences setup, giving you two different views on the same type of data. If you go to your Wireshark Preferences and select the TCP protocol settings, you'll see something called "Allow subdisector to reassemble TCP streams". Depending on wether it is checked or unchecked you get either "reassembled PDU" or "continuation" Messages in the info column.

http://ask.wireshark.org/questions/7268/http-continuation-vs-tcp-segment