Analyzing .pcap files

[akiba201]

Hi,

Does anyone one has a suggestion on tools that I can use for analyzing pcap (captured traffic)files ?

I am currently using Wireshark (higher version of Etherial) but I need to actually extract some files from tha pcap file.

I will appreaciate knowing any Windows based tools though Unix based are fine too.

 

[pansophic]

Wireshark is definitely what I would recommend. You should be able to use the "Follow Stream" functionality to separate out a stream. Some minor hex editing with a tool like WinHex should get you back to the file in short order.

Do you need to extract a large number of files? You could probably use something like PERL and the Net classes to automate the extraction. I'm pretty sure that Net:CAP will allow you to extract packets in a reasonable format.


pansophic