Image of Cortney & Jeremy

Extracting data from packet captures

by Jeremy L. Gaddis on July 13, 2009 · 3 comments

in Networking

A couple hours ago, Jeremy Stretch posted an article entitled Quick and dirty packet capture data extraction in which he shows how one can extract a JPEG image from a packet capture containing the HTTP stream.

Stretch’s method uses “foremost” to recover the original file which works, but… there’s an even quicker way to do it. Actually, just like with Perl, there’s more than one way to do it.

I made two videos showing how to extract files from data streams within Wireshark. Instead of embedding them in this post, I’m linking to them instead as they are quite large (resolution wise).

Hopefully this will be helpful to some others, it definitely has been to me. Thanks to Jeremy Stretch for the idea, and the guys who taught my SANS Comprehensive Packet Analysis (SEC 556) class for originally showing me how to do it!

{ 3 comments… read them below or add one }

Paul July 13, 2009 at 8:57 pm

Thanks for the great tip. I thought I was good with wireshark but obviusly I don’t use it enough.

Reply

Justin Buser May 1, 2011 at 12:40 am

You’re an idiot, did you really need to make a video to tell people to go to file->export->objects->http ? People do that on youtube as well and it drives me nuts, what’s the point?

Reply

None November 30, 2011 at 9:18 am

lol

Reply

Leave a Comment

Previous post:

Next post: