Hi, I have captured all network traffic with wireshark. now i want to view (export) all files(only files) that have been sent over network. Is it possible ? how to do that? asked 05 Apr '14, 06:14 hasanaliyev555 |
One Answer:
Unless your files have been transferred by HTTP or SMB this will be a lot of manual work if you want to do it with Wireshark. HTTP and SMB files can be exported from the File -> Export Objects menu. Everything else may or may not be exported by carving it out of the "Follow TCP/UDP stream" content window that you have to call for each flow. You can probably make your life a lot easier by using tools that are specialized on carving content from network packets, e.g. Network Miner. answered 05 Apr '14, 12:17 Jasper ♦♦ |