TCP Session Reconstruction

After you have collected the network traffic packets, you can reconstruct them according to the protocols they conform to. This allows you to analyze the different Internet Protocols based on TCP streams, such as POP3 or HTTP. To do this you must first capture some packets from the network and then use this feature to reconstruct them into streams. Select Capture - Reconstruct TCP Sessions from the main menu to reconstruct them. All the packets in the buffer will be processed and all the TCP flows will be displayed as shown in this screen shot.

Here are the toolbar buttons and their functions:

• Saves the captured data flow as a formatted text file (RTF) or as a raw data file that contains the data flow.
  
• Changes the selection of data flow between: client and server, client only or server only.
  
• Changes the data display format between text and hexadecimal code, as shown below.
  
• Finds a search string in the displayed text.
  
• Opens the Web Browser window to view HTTP sessions as a web-page or picture.

Here is an example showing an HTTP query in hexadecimal format:

Here is an example of how a captured HTTP session could be rendered in the Web Browser window: