Ask Your Question

Export single large message that spans across multiple packets

asked 2021-03-11 18:10:56 +0000

tuanNYAB gravatar image

I have a large emp message that spans across multiple packets. When I select "Export Specified Packets..." there's an option to export "All packets" or "Selected packet". If I choose "All packets", it saves all the messages in the captured session. If I select "Selected packet", it only saves 1 packet (which is only a part of the emp message). Is there a way to just capture one message with all its reassembed packets?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2021-03-12 08:33:42 +0000

hugo.vanderkooij gravatar image

Try "follow tcp/udp stream" first. Then you have just the stream selected and can use export selected packets.

edit flag offensive delete link more


The original captured session has 49 packets. The message I am interested in has 7 packets. When I selected "Follow TCP Stream" and tried to "Export Specified Packets", it showed 113 packets. Can you give me more detailed insructions?

The Wireshark version that I have is Wireshark-v2.0.3 - CBTCPA-v5.9-E.

tuanNYAB gravatar imagetuanNYAB ( 2021-03-12 17:02:08 +0000 )edit

You have a long obsolete custom version of Wireshark there, 2.0.x was end of life in November 2017. What's your OS?

grahamb gravatar imagegrahamb ( 2021-03-12 17:32:21 +0000 )edit

It's Windows 7.

tuanNYAB gravatar imagetuanNYAB ( 2021-03-12 18:29:33 +0000 )edit

You should consider upgrading Wireshark to the latest stable, 3.4.4, there have been many improvements since 2.0. Can you confirm the protocol you're looking at, what is "emp"?

grahamb gravatar imagegrahamb ( 2021-03-12 18:55:36 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2021-03-11 18:10:56 +0000

Seen: 321 times

Last updated: Mar 12 '21