[Winpcap-users] Size of packet captured!

[Guy Harris]

On Jul 24, 2009, at 1:58 AM, Adagio Grazioso wrote:

> If data is split into multiple packets, you can know which pkts belong
> to a single message and how to join them from the IP Header fields -
> Id, Offset and Flags.

If data is split into multiple packets *using IP fragmentation*, you  
can know which packets belong to a single message and how to join them  
from the IP Header fields - Id, Offset and Flags.

If it's split by, for example, splitting TDS messages across multiple  
TCP segments, IP fragmentation isn't involved, so that won't help.   
That's what's happening here.