Wireshark-users: Re: [Wireshark-users] Using TCP-reassembly
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 24 Aug 2007 13:01:03 -0700
John Smith wrote:


Is there a way to export caps from Wireshark with the TCP `magically`
reassemebled so that my program can just treat the split packets as
really big TCP packets(ignoring the ethernet MTU)?


No.
However, there *is* a way to construct a "tap" that will get handed information about all SMB packets, so it might be possible to, instead of writing a standalone program, write a tap for Wireshark/TShark to extract that data.