Is there a way to save reassembled TCP in Wireshark

Question

I am trying to sniff a POST request with multiple parts this way using Wireshark. When viewing the capture, I can select "Reassembled TCP", which will contain the header and all the data in the transfer. However, I cannot select everything to save it. If I return to the presentation of the frame, I can select a frame that usually selects the entire transmission, but it will only save the message data.

How to save all collected TCP?

Answer 1

Good, very simple. There is a heading after “Transmission Control Protocol (TCP)” and “Hypertext Transfer Protocol” called “[Reassembled TCP Segments]”. Selecting this option saves reassembled TCP segments. Pay attention to yourself to expand the focus a little.

Answer 2

Use the Follow TCP stream parameter: http://linuxonly.nl/docs/38/117_Wireshark.html

Answer 3

Works only for HTTP, DICOM, or SMB streams, but now there is the Export Objects option .

You can access it from File→ Export Objects→ HTTP.