luis, see the answer to the same questions answered a few weeks before.
bottomline is: tcpdump does not perform fragment reassembly and there is no way to catch the fragments bases on port numbers. /hannes Luis Del Pino wrote:
Hi, I'm Luis del Pino, What filter could I use to capture UDP datagrams and its fragments? I have this filter "dst 192.168.0.120 and (udp dst port 10005 or udp dst port 10006 or udp dst port 10007)" but it doesn't capture the fragments. I only want capture its fragments and not capture all IP datagrams. i have thought to use the fields, flag and fragment offset in the IP datagram. Thanks - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
- This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
