["Mayur Desai" <mayur.mdesai@xxxxxxxxx>]

You're exactly right Guy.  The definition of a "file" is
protocol-specific, which is what makes trying to recreate this from
packet headers so frustrating.  I was hoping someone had tried to
do this before and there was some tool which could do this for several
common protocols (http, ftp, etc.) 

- Mayur

On 3/16/06, Guy Harris <gharris@xxxxxxxxx> wrote:

Mayur Desai wrote:
> Thats not what I really want.  That just lists the size and time of the
> "capture files", not files captured.  I want to recreate the times and
> sizes of files that were transmitted and captured...for example, of the
> 10,000 packets in a capture file, 300 make up file X, another 1000 make
> up file Y, and so on.. I want to be able to go through the capture file
> and create a list that looks like
>
> file X  540k  2:30: 12.23
> file Y  894k  2:34:12.23

There's nothing in Ethereal to do that.

At what protocol layer is a "file" defined?  There's no such notion at
the TCP layer; it'd have to be at the NFS/SMB/HTTP/FTP/etc. layer.

-- 
Mayur Desai
Massachusetts Institute of Technology
Class of 2006

400 Memorial Dr. Cambridge, MA 02139
(561) 714-0271
mdesai@xxxxxxx