Please try the latest windows version on
http://www.ethereal.com/distribution/buildbot-builds/
There has been very recent changes in this area.
On Sat, 5 Feb 2005 09:35:12 -0800, Ron Norton <RNorton@xxxxxxxxxxxxxx> wrote:
>
>
> We have been using ethereal on W2k (comments below also hold for XP though)
> for a long time [0.8.x and up].
>
> One of the unique and very useful features in our situation is the "tcp
> follow stream". This is a great aid because it has allowed following a set
> of frames connected to a job whose aggregated, intact, packet data content
> we needed to be able to use for diagnosis by resending the data content.
>
> Often that content of interest in our case is a mix of both ASCII and
> binary. The windows driver for some of the devices we manufacture happens
> to output a PCX image in various situations.
>
> For ethereal 0.9.7 through 0.10.3 selecting an associated group of job
> frames for a "tcp follow stream" then shows in the ASCII display mode both
> ASCII content and either periods or in some cases a 7 bit rendition of an 8
> bit character, which is fine.
>
> For ethereal 0.9.7-0.10.3 using "save as" on such an ASCII tcp follow stream
> display produces a saved file that has both the ASCII and binary data
> intact. In our case, using a binary editor on the saved file then allowes
> recovery and viewing of the embedded-in-job pcx image for correctness.
>
> 0.10.4 generally works the same way, but has some problems and produces a
> slightly different file outcome, but the ASCII+binary feature is still
> intact in the saved-as file output, and for our purpose still is still
> workable.
>
> For 0.10.5 through 0.10.9 the "tcp follow stream, save as.." has been
> changed, either intentionally or unintentionally.
>
> What occurs in the "save as" file output from 0.10.5 and up is that the
> characters displayed in the ASCII display are what you get in the "save as
> file". This means a null, for example, gets saved in the file as a 2E,
> because a 2E, or the period, is used in the ASCII display for a
> non-printable value which destroys it's utility to us.
>
> My questions:
> -- is/was this "save as.." behavior change intentional, or
> -- is there a means to work around this I am not aware of in 0.10.5 and up,
> or?
>
> Any feedback from anyone would be greatly appreciated. Clearly we'd like to
> be able to take advantage of the newer build features/fixes as the come
> also. Right now, have to keep two versions installed.
>
> Ron Norton
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
>
>
