Wireshark · Wireshark-users: Re: [Wireshark-users] Betr: Re: Reassembly of HTTP packets

[Daniel Gramsch <dagra@xxxxxx>]

Hello Joan, hello Abhik,

thanks for your guidance. I think your proposals can help me so far.

@ Joan

I did already found the proposed column option:

"You can use in T|Wireshark a display filter: tcp.segments.
This gives you an overview of which packets contain Reassembled TCP Segments.
Packet Details (middle pane) shows you the frame numbers and payload.
"

But your proposal below seems not to work with my wireshark installation (1.0.2) under WinXP. It just filters out the reassembled packet,
not the single fragments. May be it will work, when switching to my linux installation ;-).

> Choose a frame number you want to work on.
> Next you can use display filter: tcp.reassembled_in==[frame number]. 
> Edit > Mark All Packets
> Note: don' forget to mark the frame with the reassembled PDU as well, 
> because this packet is not included in the selection.
> Save the marked packets.

However, I think I can "work around" this manually and with the help of 
some scripting when exporting the reassembled packets and parsing and 
removing/editing the according entries in my list. Thanks a lot again!

Greetings,
Daniel

> Hi Daniel,
>
> You can use in T|Wireshark a display filter: tcp.segments.
> This gives you an overview of which packets contain Reassembled TCP Segments.
> Packet Details (middle pane) shows you the frame numbers and payload.
>
> Choose a frame number you want to work on.
> Next you can use display filter: tcp.reassembled_in==[frame number]. 
> Edit > Mark All Packets
> Note: don' forget to mark the frame with the reassembled PDU as well, 
> because this packet is not included in the selection.
> Save the marked packets.
>
> Somehow display filter tcp.reassembled_in doesn't work in Tshark and I cann't
> figure out why ;-(
>
> Next you can use Tshark|awk to show you the frame numbers, frame length and
> total.
> $ tshark -r yourfile.cap -T fields -e frame.number -e frame.len | awk
> 'sum = sum + $2;END { print "Total: " sum }'
> Output:
> 1       1514
> 2       1514
> 3       1514
>  snip
> 35      1514
> 36      1514
> 37      1021
> Total: 55525
>
> ===
> Export Selected Packet Bytes....
>
> Display filter tcp.segments
> Select the packet which contents you want to save.
>
> Look in Packet Details (middle pane) "Line-based text data: text/html.
> Note: the description depends on the kind of data
> p.e. 	Compuserve GIF, Version: GIF 89a
> 			Media Type 
>
> Select the line; right-click, choose Export Selected Packet Bytes...
> and save as... (depending on kind of data)
>
> Hope this helps somehow ;-)
> Joan
>
> On Sun, 10 Aug 2008 17:25:43 +0200 Daniel Gramsch wrote:
> Hello Abhik,
>
> very fast ;-) - thank you! But I am not looking for the content of the reassembled
> packets, just for the overall packet size.
> The window under the menu (File > Export > Object > HTTP) seems to contain
> these information, so how can I exctract the two columns (packet num and
> bytes)
> from there? Just copy it and save this window content into a text file is
> not possible or am I wrong?
>
> What I want to have at last is a kind of list in the following way:
>
> http packet size 100	( this packet does not need to be reassembled, cause
> it fits in a single tcp packet )
> http packet size 1460	( this packet does not need to be reassembled, cause
> it fits in a single tcp packet )
> http packez size 1461 	( one http packet but from reassembled tcp packets
> )
> http packet size 2083	( one http packet but from reassembled tcp packets
> )
>
> And is it possible to get the "File > Export > Object > HTTP" information
> via tshark?
> As I said I just need the reassembled packet sizes and of course the packet
> number.
>
> Thanks a lot again,
> Daniel
>
>
> > Hello Daniel,
>
> > Yes, this is very much possible from the menu:
> > File > Export > Object > HTTP
>
> > Hope this helps
> > Abhik
>
> > On Sun, Aug 10, 2008 at 4:55 PM, Daniel Gramsch <dagra@xxxxxx> wrote:
> > Hello,
> >
> > is it possible to view (and export) only reassembled HTTP packets in
> > wireshark, even when their length is larger than the maximum
> > transmission unit of an ip packet? I will give an example:
> >
> > tcp packet 1 contains some HTTP data . The data size is 1460 bytes,
> > which is the max possible tcp payload in my network.
> > tcp packet 2 contains the rest of the HTTP data. The data size is f.e.
> > 900 bytes.
> >
> > The reassembled HTTP packet size is therefore 2360 bytes. It would be
> > nice if there is a possibility where only this reassembled packets could
> > be viewed or better saved via wireshark. So how can this be done?
> >
> > Thanks for your help,
> > Daniel
> > _____________________________