Wireshark · Wireshark-users: Re: [Wireshark-users] Using TCP-reassembly

[Guy Harris <guy@xxxxxxxxxxxx>]

John Smith wrote:

> Is there a way to export caps from Wireshark with the TCP `magically`
> reassemebled so that my program can just treat the split packets as
> really big TCP packets(ignoring the ethernet MTU)?

No.

However, there *is* a way to construct a "tap" that will get handed 
information about all SMB packets, so it might be possible to, instead 
of writing a standalone program, write a tap for Wireshark/TShark to 
extract that data.