On Jul 3, 2007, at 8:50 PM, [EMAIL PROTECTED] wrote: > Thanks, > Sorry for misleading, but I forgot to say that I refer to the third > pain > in > witch the address is the phisical address or the length in bytes > ( in hexa) > from the start of the packet.
There are probably multiple tabs in the third pane. If the HTTP request or response is in multiple link-layer packets (a large response probably will be, and a large PUT or POST request might be), then one of those tabs will be the raw data for the last of those link-layer packets, and another one will be the reassembled HTTP request or response, containing data from all of the multiple link- layer packets. For the reassembled request or response, the data offsets (what you refer to as the "address") obviously cannot refer to the particular link-layer packet at which you're looking, as not all of the data in the reassembled request or response is *part* of the particular link- layer packet at which you're looking. Instead, they're relative to the beginning of the reassembled data. _______________________________________________ Wireshark-users mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-users
