Wireshark-dev: Re: [Wireshark-dev] Questions about New Export Objects
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 26 Apr 2013 19:51:48 -0700
On Apr 26, 2013, at 7:41 PM, zzl  <greoge_007@xxxxxxx> wrote:

> I mean the wireshark now can only  export objects embedded in one packet(http,smb,dicom packet)

No.  Wireshark can reassemble multiple TCP segments into an HTTP request or response.

> I want to know whether this extension also just need to export objects from one ftp/smtp packet, or I need to export an object that split in several ftp/smtp packets.

If an object takes more than one TCP segment, the extension should reassemble the object from those segments and export it.