6

In wireshark sometimes I see this:

478195  5738.896809 192.168.1.79    61.213.44.124   TCP [TCP segment of a reassembled PDU]

What is a PDU? Was it reassembled? What does this mean?

1

2 Answers 2

6

A "PDU" is a "Protocol Data Unit." One unit of information being transferred in accordance with a given protocol (e.g., "login USERNAME very-long-base64-encoded-authentication-data" then wait for server to respond) will be disassembled into many packets (smaller pieces) if it's too large to fit in one packet (or segment in this case).

This is normal and is just TCP/IP working as designed.

-1

This might also be wireshark misinterpreting the underlying application level protocol, e.g. the first two data bytes are "00 01". Try turning off reassembly of TCP streams (edit -> preferences -> select TCP in Protocols -> uncheck "Allow subdissector to reassemble TCP streams"), and see what it shows as the data payload. If the data corresponds to your application protocol, then this is most likely wasn't a reassembled PDU, just wireshark misinterpretation.

1
  • Welcome to Super User! On this Q&A site we try to provide good answers to questions people ask. Part of providing a good answer is making sure you fully read the question and understand what's being asked. In this case, the question was about what PDU means, not how you might see a different interpretation of the data.
    – Cas
    Nov 9, 2016 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.