Which Wireshark feature helps you handle IP fragmentation when analyzing TCP streams?

• A. Enable IP fragmentation reassembly in Preferences
• B. Enable TCP reassembly in Preferences so fragmented IP packets are reassembled for analysis
• C. Enable TLS decryption
• D. Use Follow TLS Stream

Answer: (B)

When TCP data is spread across multiple IP fragments, theTCP dissector needs to reassemble the pieces to show a coherent stream. Enabling TCP reassembly in Preferences activates the mechanism that stitches together TCP segments even when they arrive in fragmentary IP datagrams, giving you a complete, ordered view of the TCP stream. This is essential for accurate analysis of the connection, including payload, sequence numbers, and ACKs. TLS decryption and following TLS Stream don’t address how fragmented IP packets are combined into a usable TCP stream. There is an IP fragmentation reassembly option, but for analyzing TCP streams across fragmentation, TCP reassembly is the most relevant feature because it directly restores the integrity of the TCP conversation.