Wireshark-dev: Re: [Wireshark-dev] Questions about New Export Objects

From: "jin.huang" <54jin.huang@xxxxxxxxx>
Date: Sat, 27 Apr 2013 12:01:38 +0800
Thank you !
I misunderstood the "packet number" meaning. Beause the objects I captured are very small, and can embedded in one packet, I'll try to capture large objects to check it!
 
2013-04-27

jin.huang

From:Guy Harris
Date:2013-04-27 11:40
Subject:Re: [Wireshark-dev] Questions about New Export Objects
To:"Developer support list for Wireshark"<wireshark-dev@xxxxxxxxxxxxx>
Cc:
 
 
On Apr 26, 2013, at 8:09 PM, Jin Huang <54jin.huang@xxxxxxxxx> wrote: 
 
> Wireshark really can reassemble multiple TCP segments into an HTTP request or response.  
> But the export objects function can only export objects in one packet, in the Wireshark Export dialog box, every export object has a corresponding packet number 
 
That's the frame number of the last frame that contains data from the object. 
 
It is *NOT* the only frame from which the save operation takes data. 
 
(Yes, I just tried it on an HTTP capture that has a GIF that took multiple TCP segments.  It saves the *reassembled* object, *not* just stuff from the last frame.) 
___________________________________________________________________________ 
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx> 
Archives:    http://www.wireshark.org/lists/wireshark-dev 
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev 
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe