Packet reassembling, What is it, How ethereal handles it – Lucent Technologies Ethereal User Manual
Page 137: Reassembling is disabled by default, Section 7.3, “packet reassembling
7.3. Packet Reassembling
7.3.1. What is it?
Often network protocols needs to transport large chunks of data, which are complete in itself, e.g.
when transferring a file. The underlying protocol might not be able to handle that chunk size (e.g.
limitation of the network packet size), or is stream-based like TCP, which doesn't know data chunks
at all.
In that case the network protocol has to handle that chunks itself and (if required) spreading the data
over multiple packets. It also needs a mechanism to find back the chunk boundaries on the receiving
side.
Tip!
Ethereal calls this mechanism reassembling, although a specific protocol specification
might use a different term for this.
7.3.2. How Ethereal handles it
For some of the network protocols Ethereal knows of, a mechanism is implemented to find, decode
and display this chunks of data. Ethereal will try to find the corresponding packets of this chunk,
and will show the combined data as additional pages in the "Packet Bytes" pane, see
.
Note!
Reassembling might take place in several protocol layers, so it's possible that multiple
tabs in the "Packet Bytes" pane appear.
Note!
You will find the reassembled data in the last packet of the chunk.
An example: In a HTTP GET response, the requested data (e.g. a HTML page) is returned. Ethereal
will show the hex dump of the data in a new tab "Uncompressed entity body" in the "Packet Bytes"
pane.
7.3.3. Reassembling is disabled by default!
Reassembling is usually disabled in the preferences by default, as it slows down packet processing a
bit.
Enabling reassembling of a protocol typically requires two things:
1.
the lower level protocol (e.g., TCP) must support reassembly. Often this reassembly can be en-
abled or disabled via the protocol preferences.
2.
the higher level protocol (e.g., HTTP) must use the reassembly mechanism to reassemble frag-
mented protocol data. This too can often be enabled or disabled via the protocol preferences.
The tooltip of the higher level protocol setting will note you if and which lower level protocol set-
ting has to be considered too.
Advanced Features
123