Export single large message that spans across multiple packets

asked 2021-03-11 18:10:56 +0000

tuanNYAB
1 ●2 ●1

I have a large emp message that spans across multiple packets. When I select "Export Specified Packets..." there's an option to export "All packets" or "Selected packet". If I choose "All packets", it saves all the messages in the captured session. If I select "Selected packet", it only saves 1 packet (which is only a part of the emp message). Is there a way to just capture one message with all its reassembed packets?

answered 2021-03-12 08:33:42 +0000

hugo.vanderkooij
76 ●190 ●4

Try "follow tcp/udp stream" first. Then you have just the stream selected and can use export selected packets.

edit flag offensive delete link

Comments

The original captured session has 49 packets. The message I am interested in has 7 packets. When I selected "Follow TCP Stream" and tried to "Export Specified Packets", it showed 113 packets. Can you give me more detailed insructions?

The Wireshark version that I have is Wireshark-v2.0.3 - CBTCPA-v5.9-E.

tuanNYAB ( 2021-03-12 17:02:08 +0000 )edit

You have a long obsolete custom version of Wireshark there, 2.0.x was end of life in November 2017. What's your OS?

grahamb ( 2021-03-12 17:32:21 +0000 )edit

It's Windows 7.

tuanNYAB ( 2021-03-12 18:29:33 +0000 )edit

You should consider upgrading Wireshark to the latest stable, 3.4.4, there have been many improvements since 2.0. Can you confirm the protocol you're looking at, what is "emp"?

grahamb ( 2021-03-12 18:55:36 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Export single large message that spans across multiple packets

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Export single large message that spans across multiple packets edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Export single large message that spans across multiple packets