Wireshark-users: Re: [Wireshark-users] [Winpcap-users] Http addressing with Ethereal

From: <ceo@xxxxxxxxxxxxx>
Date: Wed, 4 Jul 2007 05:50:23 +0200

Thanks,

Sorry for misleading, but I forgot to say that I refer to the third pain in witch the address is the phisical address or the length in bytes ( in hexa) from the start of the packet.

Thanks

I. lesher

This is a Wireshark (the new name for Ethereal, as of a little over a year ago) issue, not a WinPcap issue; I'm redirecting it to the wireshark-users mailing list, which is the list where questions about Wireshark should be asked. Further discussion should take place on that list. See

http://www.wireshark.org/lists/

for information on Wireshark mailing lists.

What do you mean by "follow the addressing of the whole packet" and "specific to the HTTP data"?

The first column is probably the frame number, and the second column is usually the packet time stamp. Do you mean the third column? If so, that's usually the source IP address, which would be the IP address that sent the packet; IP has no idea whether it's sending HTTP or not. An IP datagram has an IP address; there is no notion that part of one IP datagram has one IP address and another part has another address, so the only addressing is "the addressing of the whole packet" - there's no addressing specific to the HTTP data.