Wireshark-users: [Wireshark-users] Reassembly of HTTP packets

From: Daniel Gramsch <dagra@xxxxxx>
Date: Sun, 10 Aug 2008 14:55:26 +0200

Hello,

is it possible to view (and export) only reassembled HTTP packets in wireshark, even when their length is larger than the maximum transmission unit of an ip packet? I will give an example:

tcp packet 1 contains some HTTP data . The data size is 1460 bytes, which is the max possible tcp payload in my network. tcp packet 2 contains the rest of the HTTP data. The data size is f.e. 900 bytes.

The reassembled HTTP packet size is therefore 2360 bytes. It would be nice if there is a possibility where only this reassembled packets could be viewed or better saved via wireshark. So how can this be done?

Thanks for your help,
Daniel