Luis Del Pino wrote:
Hello, i have a question. I am filtering UDP segments by port. In fragmented packets, i only capture the UDP segment and i can't capture the other fragments. My questions are: could the fragments loss? or if a fragment is lost in the network, the UDP segment entirely is it lost?. i'm sorry for my English.
UDP port numbers are only contained in the first fragment - and tcpdump does not reassemble fragments that means you will loose all non-zero fragments. /hannes - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
