Hi. I see that newer versiopns of Ethereal claim to do proper desegmentation of DNS packets split over multiple TCP segments. I'm not sure what I'm doing wrong, but it doesn't seem to work. I'm using 0.9.3, installed from the RPMS on www.ethereal.com. When getting a response that spans multiple segments (dig for huge.foo.xbill.org, if anyone wants to try it) and decoding it, I see [Short Frame: DNS] in the first segment, and [Unreassembled Packet: DNS] in the second (and last). The 'Desegment all DNS packets' option is enabled. I don't see an obvious way to specify explicitly that these segments are part of the same packet and should be decoded as such. Am I missing something? Brian
Powered by MHonArc 2.6.10