Re: What is "Export PDUs to File..." intended to do?

[Anders Broman <anders.broman () ericsson com>]

-----Original Message-----
From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Guy Harris
Sent: den 16 juli 2014 12:00
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] What is "Export PDUs to File..." intended to do?


On Jul 15, 2014, at 10:55 PM, Pascal Quantin <pascal.quantin () gmail com> wrote:

> Le 16/07/2014 03:05, Guy Harris a écrit :
> > Currently, it writes something to a temporary file, and then closes the current file and reads the new file in.
> >
> > 1) What do the four choices it offers mean?  I tried it with "OSI Layer 3" on an HTTP capture and no packets were 
> > written.
> The idea is to strip the lower layers or create a new pcap with the 
> deciphered payload for example.
> As of today, if you select "OSI layer 3" it will export PDUs from 
> IPSec and SCTP.

Those aren't the only protocols in the universe at the transport layer - and I'm not sure IPSec is a transport-layer 
protocol.

Perhaps it should say "IPSec and SCTP" instead?

That may be come long winded if more protocols are added...

> If you select "OSI layer 7", it will export the (eventually
> deciphered) payload for credssp, diameter, DTLS, reload, SIP and SSL.

Ditto.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe