Wireshark-users: Re: [Wireshark-users] [Winpcap-users] Http addressing with Ethereal
On Jul 3, 2007, at 8:50 PM, ceo@xxxxxxxxxxxxx wrote:
Thanks,
Sorry for misleading, but I forgot to say that I refer to the third
pain
in
witch the address is the phisical address or the length in bytes
( in hexa)
from the start of the packet.
There are probably multiple tabs in the third pane.
If the HTTP request or response is in multiple link-layer packets (a
large response probably will be, and a large PUT or POST request might
be), then one of those tabs will be the raw data for the last of those
link-layer packets, and another one will be the reassembled HTTP
request or response, containing data from all of the multiple link-
layer packets.
For the reassembled request or response, the data offsets (what you
refer to as the "address") obviously cannot refer to the particular
link-layer packet at which you're looking, as not all of the data in
the reassembled request or response is *part* of the particular link-
layer packet at which you're looking. Instead, they're relative to
the beginning of the reassembled data.
