Wireshark-users: Re: [Wireshark-users] [Winpcap-users] Http addressing with Ethereal

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 5 Jul 2007 19:21:39 -0700

On Jul 3, 2007, at 8:50 PM, ceo@xxxxxxxxxxxxx wrote:

Thanks,

Sorry for misleading, but I forgot to say that I refer to the third pain

in

witch the address is the phisical address or the length in bytes ( in hexa)

from the start of the packet.

There are probably multiple tabs in the third pane.

If the HTTP request or response is in multiple link-layer packets (a large response probably will be, and a large PUT or POST request might be), then one of those tabs will be the raw data for the last of those link-layer packets, and another one will be the reassembled HTTP request or response, containing data from all of the multiple link- layer packets.

For the reassembled request or response, the data offsets (what you refer to as the "address") obviously cannot refer to the particular link-layer packet at which you're looking, as not all of the data in the reassembled request or response is *part* of the particular link- layer packet at which you're looking. Instead, they're relative to the beginning of the reassembled data.