Is there a filter in Wireshark to select all the "TCP segment of a reassembled PDU" packet?
1 Answer
Enter in the Filter box: tcp.reassembled_in
This works to filter packets that have already been read, but it's not so good at handling new packets during a live capture. I think that's because the "reassembled" attribute is not knowable until all the packets participating in the reassembly have arrived (it's a forward pointer to the final packet in the group). By the time the reassembly is done, it's too late to change the filter's decision not to display the earlier packets.
2
