-
Bug
-
Resolution: Unresolved
-
Minor
-
None
-
None
-
False
-
None
-
False
-
-
When a tcpdump/tshark/wireshark PCAP file on UDP is parsed, ParseMessages cannot read IP packets that are the result of fragmentation of a UDP datagram that is larger than the MTU.
The reason is that each data section of a fragmented IP packet has a 16 byte header before the real data starts.
Perhaps we can instruct tcpdump to skip IP fragments and only capture UDP datagrams?