Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Merging HTTP packets

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 10 Apr 2008 21:32:36 -0700
Yang Zhang wrote:
Hi, I captured some packets with the filter "tcp port 80 and host www.facebook.com". As a result I see a bunch of individual packets - some HTTP, some just TCP, with many of the HTTP messages segmented.

I can ignore the TCP-only packets by typing in 'http' in the filter box, but is there some way to merge the HTTP packets to be whole, unsegmented requests/responses?

Do you have the HTTP preferences

	Reassemble HTTP headers spanning multiple TCP segments

	Reassemble HTTP bodies spanning multiple TCP segments

and the TCP preference

	Allow subdissector to reassemble TCP streams

turned on?  If so, Wireshark should reassemble HTTP requests and responses.