Exam 200-201 topic 1 question 145 discussion

B is correct

Answer must be D? The TCP protocol preference “Allow subdissector to reassemble TCP streams” (enabled by default) makes it possible for Wireshark to collect a contiguous sequence of TCP segments and hand them over to the higher-level protocol (for example, to reconstruct a full HTTP message). 7.8. Packet Reassembly - Wiresharkhttps://www.wireshark.org ›

B is correct

The answer is D. unfragment TCP. The Option B, "extract a file from a packet capture", would allow you to save a file from a packet capture. This would not affect the TCP streams in the capture file

Its B. Protocols such as HTTP or TLS are likely to span multiple TCP segments. The TCP protocol preference “Allow subdissector to reassemble TCP streams” (enabled by default) makes it possible for Wireshark to collect a contiguous sequence of TCP segments and hand them over to the higher-level protocol (for example, to reconstruct a full HTTP message). All but the final segment will be marked with “[TCP segment of a reassembled PDU]” in the packet list

The expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled is that it allows TCP subdissectors to reassemble TCP streams. Therefore, the correct answer is A. The "Allow subdissector to reassemble TCP streams" feature in packet capture software enables TCP subdissectors to reassemble TCP streams, which allows the user to see the entire conversation between two endpoints. This feature does not relate to file extraction or unfragmenting TCP, so options B and D are incorrect.

The detail is in the question 'what is the expected result' = D Yes you can extract a file that is unfragmented, but this is an example of what could be done..

i agreed with answer D. but not sure unfragmented TCP ==> Allow subdissector to reassemble TCP streams.

D agreed

During a TCP transmission of datagrams between two devices, each packet is tagged with a sequence number by the sender. This sequence number is used to reassemble the packets back into data. During the transmission of packets, each packet may take a different path to the destination. So best answer is D, deals with reassembling!