Which option is used to reassemble out-of-order TCP segments in Wireshark?

• A. Reassemble out of order segments
• B. Reassemble DNS
• C. Reassemble UDP streams
• D. Reassemble HTTP payloads

Answer: (A)

When analyzing TCP traffic, the data arrives as a stream of bytes split into segments that can arrive out of order. The ability to reassemble out-of-order TCP segments is what lets Wireshark piece those bytes back together in the correct sequence so you see the real TCP data stream, not a jumbled order. This option tracks the TCP sequence numbers, buffers segments as needed, and fills in gaps as later segments arrive, presenting a coherent view of the conversation. It’s specifically about TCP’s behavior as a stream protocol, which is why it’s the right choice here.

The other options relate to reassembly for other protocols or contexts, not to handling out-of-order TCP segments: DNS reassembly is about DNS messages that may span multiple packets in some scenarios, UDP stream reassembly isn’t about the ordered TCP byte stream, and HTTP payload reassembly deals with the content within a TCP stream but doesn’t address ordering of TCP segments themselves.