Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Suppose I have a Wireshark log of traffic from a web site.

Can I reconstruct various elements like HTML file, picture files, java script files, etc?

Ideally, it'd take the .pcap file and automatically generate individual files.

share|improve this question
    
When you did the capture, did you make sure the snaplen was enough to capture full packets? –  Paul Jan 10 '13 at 7:11
add comment

2 Answers 2

Provided the client used a new TCP stream for each element that was downloaded, you could do this with wireshark.

Use the Follow TCP Stream option from the right-click menu on each of the TCP streams. This will give you every packet involved in that session. At the bottom of the dialog box, change the "Entire Conversation" drop down so that it just includes traffic from the server to the client.

Then you can save-as Raw, choosing the appropriate filename each time.

share|improve this answer
add comment

Why would you want to do it this way? Something not quite no the level?

Personally I have seen no program like what you describe.

In thinking about this it would be practical a fairly difficult task and best be gotten from backed up source data. The packets captured would likely not be in the same order due to windowing and retransmits and the like.

I might spend the time and effort depending on the underlying value of the information you are attempting to construct (i.e. criminal or forensics issues).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.