TCP reassembly

TCP reassembly is the process of rebuilding the ordered byte stream that each side of a TCP connection sent, from the individual segments in a capture. Segments can arrive out of order, be retransmitted, or be missing entirely, so a reassembler orders them by sequence number, trims duplicate bytes and records holes where data was never captured.

Reassembly is what makes application-level analysis possible: an HTTP response or a file transfer usually spans many packets. Missing bytes, from a small snaplen or dropped packets, show up as gaps and leave extracted files incomplete. PCAP Parser reassembles TCP streams in sequence order and reports gap bytes rather than hiding them; its walkthrough shows where.