diff --git a/README.md b/README.md index 1ad7743..80d88f6 100644 --- a/README.md +++ b/README.md @@ -104,6 +104,8 @@ In case the tshark is performing reassembly from multiple frames, the backward p To overcome this limitation it is possible to use tshark with supressed packet reassembly. To disable reassembly for specific protocol use `tshark -o :FALSE`. And for `` see `tshark -G defaultprefs`. After disabling packet reassembly, the protocol frames should be assembled correctly by json2pcap. However the masking/anonymization will not be performed for fragmented protocols. +To properly anonymize SCTP traffic, the pcap should SCTP dechunked first. + # Atribution Copyright 2020, Martin Kacer and contributors