Ethereal-users: [Ethereal-users] Re: Question about packet-http.c in Ethereal 0.10.9
kauai wrote:
Just reading through some of the open source code of
Ethereal 0.10.9 and saw your name in several places,
specifically in packet-http.c under dissectors.
That doesn't mean I'm the sole maintainer of packet-http.c; questions
about Ethereal should generally be asked on one of the Ethereal lists.
In particular...
I am curious to know if its possible or are their plans to have HTTP reconstruction done within
Ethereal.
...I didn't write the reassembly code in the current HTTP dissector.
Basically HTML, JPG/GIF, JS, etc. file recreation,
just like a browser does when you select "Save As" for
offline reading.
Is that possible with the current version?
If
1) you captured without a "snapshot length", so all the data in each
packet was saved;
2) there aren't any missing TCP segments from the data;
3) there aren't any out-of-order TCP segments in the data;
4) the file was transmitted with a Content-Length header;
then, if you've turned on the "Reassemble HTTP headers spanning multiple
TCP segments" and "Reassemble HTTP bodies spanning multiple TCP
segments" preferences - and you probably want to turn on "Reassemble
chunked transfer-coded bodies" and possibly "Uncompress entity bodies" -
you can select the last packet of the HTTP transfer and it should have
the entire transferred entity reassembled. There will probably be a
protocol tree item after the "Hypertext Transfer Protocol" item,
containing the entity body; select that protocol tree item, and then
select the File -> Export -> Selected Packet Bytes menu item, which
should let you save the selected bytes - i.e., the entire entity body -
to a file.
Thanks for any help,
Kauai
__________________________________
Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo
