Loic Minier wrote:
> I would like to save data packets of a specific protocol layer in
> real time to files.
> I thought using tethereal with the -V and -x options would permit
> another program to filter it's output but the output is different in
> the case of a fragmented packet and in the case of a single
> non-fragmented packet.
> I'm interested in the Reassembled WTP part, however I'd like to get
> this dump for all WSP packets, also for those that fit in a single WTP
> packet.
>
> Is this possible in a way with current (t)ethereal?
> If not, is it something someone could be interested in - besides me -
> (read: should it be ugly hacked or nicely coded for all protocols)?
I don't think you can get it without modifying the source code.
I had a similar need for e.g. TPKT (with H.245/H.225) and a while ago and as a temporar solution I added e.g. a add_new_data_source(pinfo,my_tvb,"TPKT-DATA") in the TPKT dissector when I built my own version of Ethereal/Tethereal. That way I could get the complete/reassembled TPKT packets in the Tethereal/Ethereal printout and then I could use a separate program to extract the TPKT data from the printout and convert it into the format I needed it.
I think it would be good to have a feature to dump the complete/reassembled PDUs somehow for different protocols.
