THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question

Revision history  [back]

Revision 1
SYN-bit's avatar
18.5k
SYN-bit
answered 2019-09-23 20:34:36 +0000

When you see a lot of "Ignored unknown record" messages, it usually means reassembly is failing at some point. Can you make sure you have set the following protocol preferences:

  • Make sure checksum checking is off at the ethernet, IP and TCP layer (as a checksum error will stop reassembly)
  • Make sure "Allow subdissectors to reassemble TCP streams" is enabled in the TCP protocol preferences
  • Make sure "Reassemble TLS records spanning multiple TCP segment" is enabled in the TLS protocol preferences
  • Make sure "Reassemble TLS application data spanning multiple TCP records" is enabled in the TLS protocol preferences