Home page logo

wireshark logo Wireshark mailing list archives

Re: Questions about New Export Objects
From: Guy Harris <guy () alum mit edu>
Date: Fri, 26 Apr 2013 20:39:56 -0700

On Apr 26, 2013, at 8:09 PM, Jin Huang <54jin.huang () gmail com> wrote:

Wireshark really can reassemble multiple TCP segments into an HTTP request or response. 
But the export objects function can only export objects in one packet, in the Wireshark Export dialog box, every 
export object has a corresponding packet number

That's the frame number of the last frame that contains data from the object.

It is *NOT* the only frame from which the save operation takes data.

(Yes, I just tried it on an HTTP capture that has a GIF that took multiple TCP segments.  It saves the *reassembled* 
object, *not* just stuff from the last frame.)
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]