Wireshark-users: Re: [Wireshark-users] Merging HTTP packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 10 Apr 2008 21:32:36 -0700
Yang Zhang wrote:
Hi, I captured some packets with the filter "tcp port 80 and host www.facebook.com". As a result I see a bunch of individual packets - some HTTP, some just TCP, with many of the HTTP messages segmented.
I can ignore the TCP-only packets by typing in 'http' in the filter box, but is there some way to merge the HTTP packets to be whole, unsegmented requests/responses? 

Do you have the HTTP preferences

	Reassemble HTTP headers spanning multiple TCP segments

	Reassemble HTTP bodies spanning multiple TCP segments

and the TCP preference

	Allow subdissector to reassemble TCP streams

turned on?  If so, Wireshark should reassemble HTTP requests and responses.