Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have multiple browsers and I want save all images with size more than 30KB and save to specified address.

What is best way?

  • listen to tcpdump and read the content, and then save to a file, or

  • use something like squid

I think tcpdump is better but I don't know how to find out whether the content is an image and of what size (and other attributes) to save it in a file.

share|improve this question
Duplicate? "How to recover a file from a tcpdump" (The answer there should provide what you need, I suppose.) Oh, and there's driftnet, the perfect fit. – sr_ May 9 '12 at 8:51
there is diffrent between this and that page. i want save from all addres – Efazati May 9 '12 at 17:56
For example driftnet takes a libpcap-filter expression; but maybe I misunderstood you... – sr_ May 9 '12 at 18:23
@sr_ so answer this question ;) i want all saw images in net with more 30kb size save in /opt/pics/ – Efazati May 9 '12 at 18:32
sr_ i found driftnet too helpful thanks – Efazati May 9 '12 at 19:57
up vote 2 down vote accepted

Thanks to sr_, I used driftnet:

sudo driftnet -i eth0 -a -d ./browserPic
share|improve this answer

you can use justniffer-grab-http-traffics a python script shipped with justniffer for capturing all files in HTTP traffic

share|improve this answer

I also have some small tutorial on tcpdump, I hope it will be useful.

Use tcpdump to capture in a pcap file (wireshark dump)

Remote packet capture using WireShark & tcpdump

share|improve this answer
Posting only links to external sources is frowned upon here. Your posts should contain enough information to stand on there own without the links. Having links for extra information is fine though. – Mat Nov 29 '12 at 13:33

You can use IPS (Intrusion protection) File store option.

Simplewall uses Suricata IPS latest stable integration is very simple and easy to with nice web user interface.

Files signatures :

Simply store all files to disk:-

alert http any any -> any any (msg:"FILE store all"; filestore; sid:1; rev:1;)

Store all files with extension pdf:-

alert http any any -> any any (msg:"FILE PDF file claimed"; fileext:"pdf"; filestore; sid:2; rev:1;)
drop ip any 443 -> any (msg:"File extension => swf block for User38 "; fileext:"swf"; filestore ;sid:96676215;rev:1;)
drop ip any 443 -> any (msg:"File extension => flv block for User38 "; fileext:"flv"; filestore ;sid:45369914;rev:1;)
drop ip any 443 -> any (msg:"File extension => mp3 block for User38 "; fileext:"mp3"; filestore ;sid:87448154;rev:1;)
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.