I'm looking for a way to extract binaries from PCAP's using the command line. I realize it is possible using Wireshark -> File -> Export -> http objects etc. But tshark doesn't seem to support this.

Is there a way to do this or code around this, preferably using python or bash. Or does anyone know of tools that can do this that I am not aware of.

I'd prefer if the method is automatable / scriptable.


I think tcpextract is what you're looking for.

  • I will look in to it. Not accepting yet, going to see if other people suggest other tools. +1 – delh Nov 9 '12 at 15:31

As of Wireshark 2.3.0, you can export HTTP objects with tshark. (Wireshark 2.3.0 hasn't been released yet, so you can grab a daily build from here.)

To extract HTTP objects from the command-line, run the following command:

tshark -r mypcap.pcap --export-objects "http,destdir"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.