Wireshark does not show fragmented SIP packets

From Kolmisoft Wiki
Jump to navigationJump to search

The Problem

Wireshark does not show fragmented SIP packets (usually INVITE packets), it looks like this in the Wireshark interface:

Wireshark fragmented pcap.png



The Solution

Disable (uncheck) 'Reassemble fragmented IP datagrams' option.

The option is available under Edit --> Preferences --> Protocols --> IPv4 window

Wireshark reassemble setting.png

With the option Reassemble fragmented IP datagrams disabled, Wireshark will display a fragmented SIP message

Wireshark not fragmented pcap.png




See also

Retrieved from "https://wiki.kolmisoft.com/index.php?title=Wireshark_does_not_show_fragmented_SIP_packets&oldid=28342"