Wireshark mailing list archives
Re: Questions about New Export Objects
From: Guy Harris <guy () alum mit edu>
Date: Fri, 26 Apr 2013 20:39:56 -0700
On Apr 26, 2013, at 8:09 PM, Jin Huang <54jin.huang () gmail com> wrote:
Wireshark really can reassemble multiple TCP segments into an HTTP request or response. But the export objects function can only export objects in one packet, in the Wireshark Export dialog box, every export object has a corresponding packet number
That's the frame number of the last frame that contains data from the object. It is *NOT* the only frame from which the save operation takes data. (Yes, I just tried it on an HTTP capture that has a GIF that took multiple TCP segments. It saves the *reassembled* object, *not* just stuff from the last frame.) ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Questions about New Export Objects zzl (Apr 26)
- <Possible follow-ups>
- Questions about New Export Objects Ashish (Apr 26)
- Re: Questions about New Export Objects zzl (Apr 26)
- Re: Questions about New Export Objects Guy Harris (Apr 26)
- Re: Questions about New Export Objects Jin Huang (Apr 26)
- Re: Questions about New Export Objects Guy Harris (Apr 26)
- Re: Questions about New Export Objects jin.huang (Apr 26)
- Re: Questions about New Export Objects zzl (Apr 26)