[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

You can save the content in binary of any PDU in ethereal by clicking
it to select it in the dissect pane
and then right-click to bring up the context specific popup.
In this popup pick "Export selected packet bytes" and save it to a file.


I am not sure but your mentioning of Continuation in the text below
makes me suspect it,
Is the reason you want to do this so that you can paste together a
large HTTP PDU spanning multiple segments together?

If so,  have you tried enabling 
Edit/Preferences/Protocols/TCP/Allow subdissector to desegment TCP stream
and all four preferences in
Edit/Preferences/Protocols/HTTP/

This will allow Ethereal to reassemble all such large PDUs and display them.


Combine this with the "Export " thing above and you can save the full
reassembled PDUs to an external binary file.




On Sun, 19 Sep 2004 01:20:56 +0200, Peter Valdemar Mørch  wrote:
> I've been wondering about this for some time...
> 
> I know I can print a frame with a hex dump, and then write a program to
> parse the printed hex dump to get a binary copy of each frame, but that
> seems a round-about way to do it. Or I could use perl and Net::Pcap from
> CPAN to access the capture file too I guess.
> 
> Is this an unusual request? I would have thought it was so very normal
> and straightforward to want the binary PDU...
> 
> (Now I need this as I often need to look at HTTP. And very often it
> seems that data is contained in a frame where Info == Continuation, and
> these are not decoded - only presented as "Data (X bytes)" and available
> in the hex dump. Currently I see the contents in "Follow TCP stream" but
> was wondering: Surely there must be a way to just save the received,
> unaltered PDUs, right?)
> 
> Sincerely,
> 
> Peter
> 
> --
> Peter Valdemar Mørch
> http://www.morch.com
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>