200-201 · Question #74
Refer to the exhibit. What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?
The correct answer is D. unfragment TCP. Enabling the 'Allow subdissector to reassemble TCP streams' feature ensures that fragmented TCP segments are correctly reassembled, making the complete data stream visible for analysis.
Question
Refer to the exhibit. What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?
Exhibit
Options
- Ainsert TCP subdissectors
- Bextract a file from a packet capture
- Cdisable TCP streams
- Dunfragment TCP
How the community answered
(41 responses)- A7% (3)
- B2% (1)
- C12% (5)
- D78% (32)
Why each option
Enabling the 'Allow subdissector to reassemble TCP streams' feature ensures that fragmented TCP segments are correctly reassembled, making the complete data stream visible for analysis.
This feature does not 'insert' subdissectors; it enables existing subdissectors to function correctly with reassembled data.
While reassembly is a prerequisite for extracting files, the direct result of enabling this feature is the reassembly itself, not the file extraction.
This feature enables TCP stream reassembly, it does not disable TCP streams; rather, it makes them more comprehensible.
When this feature is enabled in a packet analyzer, it processes and reassembles TCP segments that have been fragmented across multiple packets. This allows subdissectors to analyze the complete TCP payload as a single logical unit, which is essential for proper protocol decoding and viewing the full, unfragmented data stream.
Concept tested: Packet analyzer TCP reassembly
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChBuildProtocols.html
Topics
Community Discussion
No community discussion yet for this question.
