Ask Your Question
0

Follow a stream, saving to file not consistent, intended or not?

asked 2021-12-01 16:50:49 +0000

Danno gravatar image

After selecting the menu option to Follow a UDP stream, I noticed something when selecting to display the data (as ASCII, Hex Dump or Raw) and then saving to a file.

1.) When 'ASCII' is selected and then saved, as expected, the file will contain what is shown in the follow dialog.

2.) When 'Hex Dump' is selected and then saved, as expected, the file will contain what is shown in the follow dialog.

3.) But when 'Raw' is selected and then saved, the file will NOT contain what is shown in the follow dialog. The file contains the actual raw bytes exactly as taken from the wire. It is a binary file and not a file which contains human readable hex byte characters (as displayed on dialog).

Is this the intended behavior for saving in Raw format?

I'm happy with its behavior and this is exactly what I need but it doesn't conform to other display behaviors. I don't want to rely on something that will be corrected in a later release.

Thanks

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted
0

answered 2021-12-01 17:27:53 +0000

Chuckc gravatar image

From the Wireshark User’s Guide (Following Protocol Streams):

"Raw

This allows you to load the unaltered stream data into a different program for further examination. The display will look the same as the ASCII setting, but “Save As” will result in a binary file."

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-12-01 16:50:49 +0000

Seen: 82 times

Last updated: Dec 01 '21