Is there a way to place the BPF filter after IP packet reassembly?
Otherwise, matching for TCP port, etc. fails to capture fragments which do not have the TCP header and the resulting file is missing some data.
Otherwise, matching for TCP port, etc. fails to capture fragments which do not have the TCP header and the resulting file is missing some data.
Of course that sometimes fails, so if you still have TCP fragmented segments, the next best thing is to filter by source/destination address, saving to a PCAP file, then run tshark on that file with the "-2" flag which does packet reassembly.
(I don't know if tshark can be made to do on-the-fly reassembly, that would require keeping a buffer of un-reassembled fragments until the rest of the packets are seen.)
When I was running a webserver with worldwide audience and 40+ Gbps traffic (most of that was our apk though), I saw no more than a couple fragments per second; unless there was some UDP reflection DDoS going on and I was getting fragments from that.
Lots of high profile sites don't even accept ip fragmentation because it's too costly to deal with.