Wireshark-users: Re: [Wireshark-users] Reassembly of HTTP packets

From: "Abhik Sarkar" <sarkar.abhik@xxxxxxxxx>
Date: Sun, 10 Aug 2008 20:15:53 +0400

On Sun, Aug 10, 2008 at 7:25 PM, Daniel Gramsch <daniel.gramsch@xxxxxx> wrote:
> Hello Abhik,
>
> very fast ;-) - thank you! But I am not looking for the content of the reassembled packets, just for the overall packet size.
Sorry, that was not quite clear in the original mail.

> The window under the menu (File > Export > Object > HTTP) seems to contain these information, so how can I exctract the two columns (packet num and bytes)
> from there? Just copy it and save this window content into a text file is not possible or am I wrong?
>
> What I want to have at last is a kind of list in the following way:
>
> http packet size 100    ( this packet does not need to be reassembled, cause it fits in a single tcp packet )
> http packet size 1460   ( this packet does not need to be reassembled, cause it fits in a single tcp packet )
> http packez size 1461   ( one http packet but from reassembled tcp packets )
> http packet size 2083   ( one http packet but from reassembled tcp packets )
Something like this _might_ give you what you want...
tshark -r filename.pcap -T fields -e frame.number -e tcp.len -e
tcp.segments -e http.content_length [-d tcp.port==10021,http]
The part in the [] brackets is optional if your HTTP port is not 80.
You might have to play around with the fields a bit and some scripting
and that should get it done.
>
> And is it possible to get the "File > Export > Object > HTTP" information via tshark?
Not that I am aware of but I could be wrong.

> As I said I just need the reassembled packet sizes and of course the packet number.
Within Wireshark, you could also use the custom columns feature to achieve this.