Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Using TCP-reassembly

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 24 Aug 2007 13:01:03 -0700
John Smith wrote:

Is there a way to export caps from Wireshark with the TCP `magically`
reassemebled so that my program can just treat the split packets as
really big TCP packets(ignoring the ethernet MTU)?


However, there *is* a way to construct a "tap" that will get handed information about all SMB packets, so it might be possible to, instead of writing a standalone program, write a tap for Wireshark/TShark to extract that data.