Wireshark · Ethereal-users: [Ethereal-users] Getting a "raw" binary file with a copy of a frame?

[Peter Valdemar Mørch <swp5jhu02@xxxxxxxxxxxxxx>]

I've been wondering about this for some time...

I know I can print a frame with a hex dump, and then write a program to 
parse the printed hex dump to get a binary copy of each frame, but that 
seems a round-about way to do it. Or I could use perl and Net::Pcap from 
CPAN to access the capture file too I guess.

Is this an unusual request? I would have thought it was so very normal 
and straightforward to want the binary PDU...

(Now I need this as I often need to look at HTTP. And very often it 
seems that data is contained in a frame where Info == Continuation, and 
these are not decoded - only presented as "Data (X bytes)" and available 
in the hex dump. Currently I see the contents in "Follow TCP stream" but 
was wondering: Surely there must be a way to just save the received, 
unaltered PDUs, right?)

Sincerely,

Peter

--
Peter Valdemar Mørch
http://www.morch.com