Hello,
is it possible to view (and export) only reassembled HTTP packets in
wireshark, even when their length is larger than the maximum
transmission unit of an ip packet? I will give an example:
tcp packet 1 contains some HTTP data . The data size is 1460 bytes,
which is the max possible tcp payload in my network.
tcp packet 2 contains the rest of the HTTP data. The data size is f.e.
900 bytes.
The reassembled HTTP packet size is therefore 2360 bytes. It would be
nice if there is a possibility where only this reassembled packets could
be viewed or better saved via wireshark. So how can this be done?
Thanks for your help,
Daniel
