On Fri, Jan 10, 2003 at 05:37:24PM -0000, [EMAIL PROTECTED] wrote: > (I assume this is because the > display filter created by Ethereal uses port numbers which are not > present in the second "fragmented IP protocol" fragments.
Yes, that's why. > Is there any way of following the entire stream, Select "Preferences" from the "Edit" menu, click on the "[+]" next to "Protocols" to open up the list of protocols, select "IP" from that list, turn on "Reassemble fragmented IP datagrams", click "Save" if you want Ethereal and Tethereal to *always* reassemble fragmented IP datagrams by default (i.e., if you do that, the next time you run Ethereal you won't have to do all this), and then click "OK". This will cause Ethereal to reassemble fragmented IP datagrams, so that it will see the entire GTP fragment and thus the entire IP datagram inside the GTP packet and thus the entire TCP segment inside the IP datagram.
