Wireshark - 1.0 Betriebsanweisung PDF herunterladen (Seite 156)

7.6. Packet Reassembling

7.6.1. What is it?

Network protocols often need to transport large chunks of data, which are complete in themselves,

e.g. when transferring a file. The underlying protocol might not be able to handle that chunk size

(e.g. limitation of the network packet size), or is stream-based like TCP, which doesn't know data

chunks at all.

In that case the network protocol has to handle the chunk boundaries itself and (if required) spread

the data over multiple packets. It obviously also needs a mechanism to determine the chunk bound-

aries on the receiving side.

Tip!

Wireshark calls this mechanism reassembling, although a specific protocol specifica-

tion might use a different term for this (e.g. desegmentation, defragmentation, ...).

7.6.2. How Wireshark handles it

For some of the network protocols Wireshark knows of, a mechanism is implemented to find, de-

code and display these chunks of data. Wireshark will try to find the corresponding packets of this

chunk, and will show the combined data as additional pages in the "Packet Bytes" pane (for inform-

ation about this pane, see Section 3.18, “The "Packet Bytes" pane”).

Figure 7.2. The "Packet Bytes" pane with a reassembled tab

Note!

Reassembling might take place at several protocol layers, so it's possible that multiple

tabs in the "Packet Bytes" pane appear.

Note!

You will find the reassembled data in the last packet of the chunk.

An example: In a HTTP GET response, the requested data (e.g. an HTML page) is returned. Wire-

shark will show the hex dump of the data in a new tab "Uncompressed entity body" in the "Packet

Bytes" pane.

Reassembling is enabled in the preferences by default. The defaults were changed from disabled to

enabled in September 2005. If you created your preference settings before this date, you might look

if reassembling is actually enabled, as it can be extremely helpful while analyzing network packets.

The enabling or disabling of the reassemble settings of a protocol typically requires two things:

1. the lower level protocol (e.g., TCP) must support reassembly. Often this reassembly can be en-

abled or disabled via the protocol preferences.

Advanced Topics

141

1 2 ... 151 152 153 154 155 156 157 158 159 160 161 ... 283 284

Keine Kommentare

Wireshark - 1.0 Betriebsanweisung Seite 156