Ethereal-users: Re: [Ethereal-users] Save UDP stream

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Wed, 4 Apr 2001 11:28:07 -0700 (PDT)
> Is there a way to save the data from a UDP stream (meaning, all the data
> passed between two ports on two machines) similar to the way TCP streams can
> be saved?

No.

> This has to do with a cohort of mine trying to extract the NFS
> payload from a packet capture he did using tcpdump.

What do they mean by "NFS payload"?  The "Save" button in a "Follow UDP
Stream" window, if we supported such a thing, would save the ONC RPC
headers, and save the NFS request and reply headers as well, so if
they'd expect it to, for example, save only file data from reads and
writes, they'd be likely to be disappointed.

(Note that "Follow TCP Stream" is, for binary protocols such as, say,
SMB - to pick a protocol similar to NFS in some ways - pretty much
useful *only* as a way of automatically generating a display filter to
show only the packets in the TCP connection to which the
currently-selected packet belongs; the contents of the "Follow TCP
Stream" window are pretty much just noise.)