Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] "Visually" re-assemble packet

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 8 Dec 2014 15:17:21 -0800
On Dec 8, 2014, at 2:39 PM, Christopher Smith <Christopher.Smith@xxxxxxxxx> wrote:

>>> Like, a method to parse through a trace to present its granularity on protocols vs frames?
>> 
>> So do you mean that you want a display that shows, for example, each HTTP request or response as a single line in the summary, with, for example, the length field showing the length of the request or response as a whole, with the packet details at a lower level (link-layer frame, IP, TCP) hidden?
> 
> Yes :-)

OK, so the reassembly's already being done by Wireshark, and it's just a question of the packet summary display.

That can't *fully* be done currently, but if, for example, you filter the display with a filter such as "http", it'll show only the HTTP traffic.