Let's start from teh basics.
Do you have all decoders and reassemblers enabled? Check all the boxes
in the settings for IP, TCP, HTTP, if you haven't yet. That may make
fix some binary among the text (most probably due to chunking). It
will also decompress the content if it was compressed on the fly. You
don't need to redo any captures.
Then, if you want to just see http traffic, the display filter is
'http'. If you only want to see the http responses, then you want to
use display filter 'http.response.code' or 'http.response.code==200'.
To save, for each of the resulting items you want find 'Line-Based
text data', which should be the last item in the fields (middle)
section. When you selected that, the 'File/Export/Selected Packet
Bytes' (Shortcut Ctrl-H) will save the reconstructed html file to the
disk. It does not put the headers into the same file, but they are
available by clicking on the field one line above ('Hypertext Transfer
Protocol') and exporting that (Ctrl-H again) into the separate file.
The real annoyance is that you have to repeat this for each http
response, so it is not something you will want to do for very large
batches. In those cases, you may want to look into exporting PDML and
running it through XSLT. A word of warning though, the PDML will be
HUGE.
It would be nice if somebody would build the XSLT processor into the
Ethereal and use stylesheet as PDML is generated. That could allow for
only important fields to be output if desired, but still would allow
for full PDML with Identity stylesheet. Unfortunately, I am not a C++
programmer to do it myself.
The final option is MATE (http://wiki.ethereal.com/Mate), but it is
still in development and I haven't tried it.
Let us know if any of this helped. If it did not answer your needs,
please specify exactly which step did not work (did not achieve what
your need) and why. There might be something else available that I did
not cover here.
Regards,
Alex.
On 6/14/05, michael2020@xxxxxx <michael2020@xxxxxx> wrote:
> Hi,
>
> I would like to use ethereal to log http-traffic caused by my internet
> browser. All I need are headers and text-contents of the http-packets (-->
> html, no images). First I thougt the "follow-TCP-Stream"-option would be
> great for that. However, it appears that the amount of bytes that can be
> analyzed/viewed there is limited. If it is exceeded, only http-headers are
> shown. Am I wrong/ is there any way to prevent that?