Re: some help please

[gharris <gharris () sonic net>]

> I have some delays from one site regarding internet access. From running
> ethereal I have discovered that those delays are caused by Unreassembled
> packets.

No.  When Ethereal reports an "Unreassembled Packet", that just means that
it has seen something it *thinks* is a higher-level packet that requires
more than one link-layer frame, but that Ethereal's option controlling
whether to reassemble those frames *inside Ethereal* has not been turned
on.

It does *not* mean that the packet *itself* has an error.

> All those packets (TCP Protocol [PSH, ACK]) are in downstream
> Len=6 and on upstream Len=4. Also ethereal calls it : "Unreassembled
> Packet: SKINNY".

That might just mean that the packet happenes to have been set to or from
the port number for Cisco's Skinny Client Control Protocol, and looks as
if it's more than one TCP segment in length.  It's probably *not* SCCP
traffic, which means Ethereal's processing of it can give bogus results.


-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe