On Tue, Oct 23, 2007 at 08:04:05AM -0700, Mark G. wrote:
> I am using Wireshark to capture a large number of JPEG2000 images from
> a web site. The captured images appear in the "export/objects/http"
> dialog with mime type "application/octet-stream". But their default
> filenames are invalid, having been created from the original HTTP GET
> request. So "save all" will not save these objects.
That is because all of the filenames are taken from the filename
(specifically the last characters after the final "/") in the HTTP GET
request. Usually this is provides a normal filename, but as you have
seen, it also sometimes leads to filenames that contain characters that
are invalid for the filesystem you're using (or any filesystem). There
is no good way to tell what filenames are going to be able to be
saved until Wireshark tries it and sees if it fails.
> I can select them individually and save them, but then I have to wait
> while Wireshark reads through all the packets. This is tedious. Is
> there a way to automate this? I would like to instruct Wireshark to
> assign incremental filenames to the objects, but I see no way to
> accomplish this.
I could not think of a really good way to handle these filenames that
are unsavable when I implemeneted the export object feature. Were you
hoping to save all of the objects with filenames that increment or just
the ones that are based on HTTP GET requests that cannot be saved with
their HTTP GET filenames?
Do you have any other ideas of a good way to fix this? Maybe letting
the user click on the filename field and change the ones they want to?
> Perhaps this could be done with Tshark?
The export object feature is not implemented in tshark at all.
Steve
