Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose I have a Wireshark log of traffic from a web site.

Can I reconstruct various elements like HTML file, picture files, java script files, etc?

Ideally, it'd take the .pcap file and automatically generate individual files.

share|improve this question
When you did the capture, did you make sure the snaplen was enough to capture full packets? – Paul Jan 10 '13 at 7:11

Provided the client used a new TCP stream for each element that was downloaded, you could do this with wireshark.

Use the Follow TCP Stream option from the right-click menu on each of the TCP streams. This will give you every packet involved in that session. At the bottom of the dialog box, change the "Entire Conversation" drop down so that it just includes traffic from the server to the client.

Then you can save-as Raw, choosing the appropriate filename each time.

share|improve this answer

Why would you want to do it this way? Something not quite no the level?

Personally I have seen no program like what you describe.

In thinking about this it would be practical a fairly difficult task and best be gotten from backed up source data. The packets captured would likely not be in the same order due to windowing and retransmits and the like.

I might spend the time and effort depending on the underlying value of the information you are attempting to construct (i.e. criminal or forensics issues).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.