how wireshark marks some packets as "tcp segment of a reassembled pdu" [closed]

Question

I opened a pcap in wireshark and it displays a lot of packets as "tcp segment of a reassembled pdu". How wireshark is able to determine which tcp packets are segments of a reassembled pdu ? I am not able to find any header field or anything else by which wireshark can determine this.

Any help will be greatly appreciated. THANKS !!!

Antecedent

Although the question does not involve code, i can bet every one doing network programming runs into this kind of questions WHEN coding. The are crafting / processing packets and don't understand how wireshark is showing what it does. So i answered any way. It is important to note that a person who is only viewing packets in wireshark and NOT PROGRAMMING code to process that would probably not ask about it – Trierarch

Yeah, I agree with you ! Stack over flow 逼格太高了，一大波逼哥在争先恐后的close – Barabbas

Answer 1

Sequence number is the field which helps in reassembly. Say you have data bytes 1-300 to send.

For instance they were divided into 3 segments of size 100 each i.e. first (1-100 byte number), second (101 - 200) and third (201-300). Now even if they are received out of order, sequence numbers won't change. So when reassembling data, you would know the original order of packets and hence wireshark can display the assembled packets.

If the SYN flag is clear (0), then this is the accumulated sequence number of the first data byte of this packet for the current session.

TCP

Remember, this is different from ip fragmentation and reassembly. IP header has fields to specify if there are fragments and if so, what is the fragment number of current packet.

Trierarch

Woops - some body silently down voted without any trace of what he didn't think was right... – Trierarch

You are a better man ! Your answer is very helpful to me – Barabbas

I am glad that was the case. – Trierarch