Wireshark-dev: Re: [Wireshark-dev] Questions about New Export Objects
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 26 Apr 2013 20:39:56 -0700
On Apr 26, 2013, at 8:09 PM, Jin Huang <54jin.huang@xxxxxxxxx> wrote:

> Wireshark really can reassemble multiple TCP segments into an HTTP request or response. 
> But the export objects function can only export objects in one packet, in the Wireshark Export dialog box, every export object has a corresponding packet number

That's the frame number of the last frame that contains data from the object.

It is *NOT* the only frame from which the save operation takes data.

(Yes, I just tried it on an HTTP capture that has a GIF that took multiple TCP segments.  It saves the *reassembled* object, *not* just stuff from the last frame.)