Ethereal-users: Re: [Ethereal-users] JPG-Export from captured file (TCP-Reassembly)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Olivier Biot" <ethereal@xxxxxxxxxx>
Date: Sat, 18 Dec 2004 12:15:08 +0100
Harry,
Go to Edit -> Preferences. In the left pane, click on "Protocols" so you can edit the protocol preferences.
Look at TCP, and make sure that "Allow subdissector to reassemble TCP streams" is enabled. Then look at HTTP, and enable at least the first 3 preferences (reassemble headers, reassemble bodies, reassemble chunked bodies).
Save the preferences, and reload the capture file (you may use the display filter "image-jfif or image-gif" to search for JPEG and GIF in the captured packets).
Once you found an image, click on the protocol line in the dissection window ("JPEG File Interchange Format" or "Compuserve GIF, Version: 87a/89a") so the relevant bytes get highlighted (selected), and export the selected packet bytes, either from the File menu, or by right-clicking on the packet. 

Best regards,

Olivier
----- Original Message ----- From: ThEbIg 


Hi,
i've read the tutorial about TCP-Reassembly on wiki.ethereal.com

My ethereal is configured as shown in the tutorial, but if i receive a jpg
file, which is bigger than one packet, the first packet is a http-packet
with content-type: image/jpeg, the next packets are HTTP-continuations.
So its not possible to save a valid jpg-file! :(((

I use Ethereal 0.10.3 (SUSE-Linux), could this be the problem?

Thanks for answering
Harry