Hello all,
I posted a couple days ago and it never made the forum so I appologize if this is a repeat.
First off...great software!
I have about 12 hours of Wireshark use so far. Having trouble reassembling packets downloaded from Gnutella. I can reassemble HTTP image packets n/p. Someone please tell me what Im doing wrong.
I begin a capture (wireshark latest realease), download an image file (jpg ) with only 1 host (to avoid swarming downloads). I then stop the capture and filter using the "ip.source" filter. I can then view all tcp packets downloaded from the host and checksum shows successful. I dont get the same options as I do with a HTTP Jpeg download and cant find an option to export as raw data. I even tried "follow TCP stream", stripping header info, and copy and paste the bytes to a text editor with a JPEG extension but the image wont open. I do have TCP dissector and IP reassemble ticked. Maybe Im using the wrong
filter?
Any suggestions as to how I can reassemble an image file downloaded from with Gnutella would be greatly appretiated.
Thanks
Dave
Sucker-punch spam with award-winning protection.
Try the
free Yahoo! Mail Beta.
