Ethereal-users: [Ethereal-users] Re: Question about packet-http.c in Ethereal 0.10.9

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 10 Feb 2005 01:06:18 -0800
kauai wrote:

Just reading through some of the open source code of
Ethereal 0.10.9 and saw your name in several places,
specifically in packet-http.c under dissectors.
That doesn't mean I'm the sole maintainer of packet-http.c; questions about Ethereal should generally be asked on one of the Ethereal lists.

In particular...

I am curious to know if its possible or are their plans to have HTTP reconstruction done within
Ethereal.
...I didn't write the reassembly code in the current HTTP dissector.

Basically HTML, JPG/GIF, JS, etc. file recreation,
just like a browser does when you select "Save As" for
offline reading.

Is that possible with the current version?
If

1) you captured without a "snapshot length", so all the data in each packet was saved;

   2) there aren't any missing TCP segments from the data;

   3) there aren't any out-of-order TCP segments in the data;

   4) the file was transmitted with a Content-Length header;

then, if you've turned on the "Reassemble HTTP headers spanning multiple TCP segments" and "Reassemble HTTP bodies spanning multiple TCP segments" preferences - and you probably want to turn on "Reassemble chunked transfer-coded bodies" and possibly "Uncompress entity bodies" - you can select the last packet of the HTTP transfer and it should have the entire transferred entity reassembled. There will probably be a protocol tree item after the "Hypertext Transfer Protocol" item, containing the entity body; select that protocol tree item, and then select the File -> Export -> Selected Packet Bytes menu item, which should let you save the selected bytes - i.e., the entire entity body - to a file.

Thanks for any help,
Kauai


		
__________________________________ Do you Yahoo!? Take Yahoo! Mail with you! Get it on your mobile phone. http://mobile.yahoo.com/maildemo