On Tue, 2 Apr 2002, Guy Harris wrote: > On Tue, Apr 02, 2002 at 01:41:56PM -0800, Brian Wellington wrote: > > When getting a response that spans multiple segments (dig for > > huge.foo.xbill.org, if anyone wants to try it) and decoding it, I see > > [Short Frame: DNS] > > in the first segment, and > > [Unreassembled Packet: DNS] > > in the second (and last). The 'Desegment all DNS packets' option is > > enabled. > > Is the TCP configuration option "Allow subdissector to desegment TCP > streams" option enabled? If not, enabled it (and save your > configuration, so it stays on).
Ah, that's it. Thanks! > > I don't see an obvious way to specify explicitly that these > > segments are part of the same packet and should be decoded as such. > > There isn't one. OK. If it works automatically, there's no compelling reason to allow it to be explicitly specified. > If reassembly isn't enabled in both places, they *shouldn't* be decoded > as part of the same packet. > > If reassembly *is* enabled in both places, they should automatically be > decoded as part of the same packet; if they're not, that's a bug, and > the bug should be fixed. Agreed. Brian
