Export

The country of Wireshark has developed a rich and prosperous file exporting industry

ADVANCED TOPICS
ANALYZE PCAP
OBTAIN PCAP
GET STARTED
Export Files

You must have tshark 2.4.0 or higher to use the --export-files flag.

About

tshark has the ability to reassemble files provided a packet capture. These list includes HTTP, SMB, IMF, DICOM, and TFTP for latest Wireshark. This section covers how to extract files from HTTP in both encypted and unencypted captures.

Table of Contents