mailing list archives
Re: Questions about New Export Objects
From: Guy Harris <guy () alum mit edu>
Date: Fri, 26 Apr 2013 20:39:56 -0700
On Apr 26, 2013, at 8:09 PM, Jin Huang <54jin.huang () gmail com> wrote:
Wireshark really can reassemble multiple TCP segments into an HTTP request or response.
But the export objects function can only export objects in one packet, in the Wireshark Export dialog box, every
export object has a corresponding packet number
That's the frame number of the last frame that contains data from the object.
It is *NOT* the only frame from which the save operation takes data.
(Yes, I just tried it on an HTTP capture that has a GIF that took multiple TCP segments. It saves the *reassembled*
object, *not* just stuff from the last frame.)
Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org>
mailto:wireshark-dev-request () wireshark org?subject=unsubscribe