John Smith wrote: > Is there a way to export caps from Wireshark with the TCP `magically` > reassemebled so that my program can just treat the split packets as > really big TCP packets(ignoring the ethernet MTU)?
No. However, there *is* a way to construct a "tap" that will get handed information about all SMB packets, so it might be possible to, instead of writing a standalone program, write a tap for Wireshark/TShark to extract that data. _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
