Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a filter in Wireshark to select all the "TCP segment of a reassembled PDU" packet?

share|improve this question

Enter in the Filter box: tcp.reassembled_in

This works to filter packets that have already been read, but it's not so good at handling new packets during a live capture. I think that's because the "reassembled" attribute is not knowable until all the packets participating in the reassembly have arrived (it's a forward pointer to the final packet in the group). By the time the reassembly is done, it's too late to change the filter's decision not to display the earlier packets.

share|improve this answer
it doesn't work. Which wireshark version that you are using? I am using the latest 1.10.1. – Sean Nguyen Aug 18 '13 at 14:31
Worked for me in that version, but I only checked it after the capture had stopped. I guess it doesn't work on the fly. – Wumpus Q. Wumbley Aug 18 '13 at 15:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.