Answers to: What is the difference between "Continuation or non-HTTP traffic" and "TCP segment of a reassembled PDU"<p>I have a pcap file including 2 TCP streams from the same HTTP server.Displayed in Wireshark, in the 1st stream, the content from HTTP server shown as "Continuation or non-HTTP traffic"; while the 2nd stream the content shown as "TCP segment of a reassembled PDU". I don't find any difference between the 2 kinds at TCP layer.</p> <p>Could someone tell me how Wireshark identify them? Does Wireshark check HTTP header for content-length?</p> <p>I have the pcap, but I don't know how to upload the file. Send me email for the pcap if you need check for details.</p>enSat, 24 May 2014 08:07:27 -0700Answer by shenfanren<p>I find the most properly answer in another FAQ syas: The HTTP header "Content-Length" informs the HTTP dissector of how much data is expected and it keeps asking the TCP dissector for more until it receives the required amount. </p> <p>In short word it based on if "content-length" exist or not.</p>shenfanrenSat, 24 May 2014 08:07:27 -0700 by Jasper<p>This is probably just the result of the TCP stream reassembly feature. To verify, go to Edit -&gt; Preferences -&gt; Protocols -&gt; TCP and disable "Allow subdissector to reassemble TCP streams". Now both should show "Continuation or non-HTTP traffic". Basically the reassembly feature is trying to reconstruct payloads, which is often useful for content examination.</p>JasperSat, 24 May 2014 07:38:41 -0700