On Apr 26, 2013, at 8:09 PM, Jin Huang <54jin.huang@xxxxxxxxx> wrote:
> Wireshark really can reassemble multiple TCP segments into an HTTP request or response.
> But the export objects function can only export objects in one packet, in the Wireshark Export dialog box, every export object has a corresponding packet number
That's the frame number of the last frame that contains data from the object.
It is *NOT* the only frame from which the save operation takes data.
(Yes, I just tried it on an HTTP capture that has a GIF that took multiple TCP segments. It saves the *reassembled* object, *not* just stuff from the last frame.)
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
