[Kevin Lux <luxk@xxxxxxxxxxxxxxxxxx>]

Hi everyone,

I have a half gig capture file (from ethereal) of web requests. What I
need to do is search the requests for certain keywords and record the
total bytes sent/received. The problem is the requests are large and get
fragmented. The keyword does not appear in all the packets.

I thought I could enable reassembly to have the entire request be viewed
as one segment, but didn't seem to work. The filter returns parts of the
entire response/request. I need the whole thing returned for data
collection.

My filter exp looks like "ip.src=10.0.0.54 and tcp.srcport == 80 and http
contains "Expression"".

Does anyone have any suggestions?

Thanks,
Kevin