This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi so i have been working with stream flows and its just not working i am not smart enough to grasp Hex editing and why my extracted data is not working

But i discovered the Extract Object button that works great under the file menu But some http objects are not displayed i would just like to know why and what the limits of this easy to use item is so i can know where i can use it and where not

i have tested downloading exe from a website works great but once i try and download a sample capture it does not see the object why would this be is it just that .pcap/.cap/.pcapng files are not in the data base or is there just a limited use for this feature

This question is marked "community wiki".

asked 28 Jul '16, 09:19

Reynhard%20Wouda's gravatar image

Reynhard Wouda
6335
accept rate: 0%


It may be that there are missing packets from the capture file so the object is incomplete and thus can't be exported. But it's hard to say for sure without a capture file to look at. Coincidentally, bug 12588 was recently opened regarding this very topic.

(The bug has since been closed because it wasn't actually a bug at all but merely that packets were missing from the capture file.)

permanent link

answered 28 Jul '16, 10:21

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Thanks Helps allot

But now all a need to know is will this work as an alternative to following a packet stream and saving the raw data and then compiling the file

it seems allot easier but will this be sufficient for all data in most cases or does the feature have a limitation to its use in the sense of garbing data from a packet capture and opening the file content downloaded by the user

(29 Jul '16, 03:37) Reynhard Wouda

For forensic purposes it would be beneficial if the object (with holes) could be exported. Same is done for RTP streams, where artificial silence is inserted on time stamp jumps.

(29 Jul '16, 04:48) Jaap ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×8
×3

question asked: 28 Jul '16, 09:19

question was seen: 1,613 times

last updated: 29 Jul '16, 04:48

p​o​w​e​r​e​d by O​S​Q​A