TCP session reconstruction

After you have collected the network traffic packets, you can reconstruct them according to the protocols they conform to. This allows you to analyse different Internet Protocols based on TCP streams, such as POP3 or HTTP.

First you need to capture some packets from the network, and then use this feature to reconstruct them into streams by selecting Capture - Reconstruct TCP Sessions in the main menu. All the packets in the buffer will be processed, and all the TCP flows will be displayed as shown in the screen shot:

Toolbar buttons and their functions:

	Saves the captured data flow as a formatted text file (RTF) or as a raw data file that contains the data flow.
	Changes the selection of data flow between: client and server, client only or server only.
	Changes the data display format between text and hexadecimal code, as shown below.
	Finds a search string in the displayed text.
	Opens the web browser window to view HTTP sessions as a web-page or image.

An example showing an HTTP query in hexadecimal format

An example of how a captured HTTP session could be rendered in a web browser window