Re: [Ethereal-users] Reassembled PDU's

[LEGO <luis.ontanon@xxxxxxxxx>]

VPN routers usually do some kind of tunnelling, which uses a part of
the payload of the packet so a full packet from the server might not
fit into a single packet after the router:

S --(1500)-->FW--(1500)-->R--(2 frags: (1500 - 20) + (20) )-->R--(2
fragmented packets)-->C

You could try reducing the MTU of the server (and/or the FW depending
which role it plays) to something the Encapsulated tunnel can handle.

S --(1480)-->FW--(1480)-->R--(1480)-->R--(1480)-->C


On 3/1/06, Danny Brett <danny@xxxxxxxxxx> wrote:
>
>
>
> Hi all,
>
>
>
> I'm monitoring a problem application and am seeing a lot of 'reassembled
> PDU' frames from the server back to the client.
>
>
>
> The network looks like this:
>
>
>
> Server --- Firewall --- VPN Router --- WAN --- VPN Router --- Client
>
>
>
> I'm monitoring between the firewall and the router and/or server and
> firewall.
>
>
>
> These frames are not at the maximum MTU size, some are as small as 60 bytes.
> Am I right in thinking the 'reassembled PDU' message is stating that the
> frame is part of a larger segment or that this a fragmented frame?
>
>
>
> I think I understand what's going on but thought I would call on the wisdom
> of ethereal-users to help me out! :o)
>
>
>
> Thanks.
>
> DB
>
>  ________________________________
>
>
>
>
> The above information is confidential to the addressee and may be
> privileged. Unauthorised access and use is prohibited. Internet
> communications are not secure and therefore this Company does not accept
> legal responsibility for the contents of this message. If you are not the
> intended recipient, any disclosure, copying, distribution, or any action
> taken or omitted to be taken in reliance on it, is prohibited and may be
> unlawful. The sender does not accept any responsibility for viruses and it
> is your responsibility to scan the email and any attachments.
>
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
>
>


--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan