This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

have captured all network traffic with wireshark. now i want to view (export) all files(only files) that have been sent over network

0

Hi, I have captured all network traffic with wireshark. now i want to view (export) all files(only files) that have been sent over network. Is it possible ? how to do that?

asked 05 Apr '14, 06:14

hasanaliyev555's gravatar image

hasanaliyev555
11112
accept rate: 0%


One Answer:

0

Unless your files have been transferred by HTTP or SMB this will be a lot of manual work if you want to do it with Wireshark. HTTP and SMB files can be exported from the File -> Export Objects menu. Everything else may or may not be exported by carving it out of the "Follow TCP/UDP stream" content window that you have to call for each flow.

You can probably make your life a lot easier by using tools that are specialized on carving content from network packets, e.g. Network Miner.

answered 05 Apr '14, 12:17

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%