how do you read wireshark capture files?
I would like to open a pre-captured wireshark file as http in order to extract data
1 Answer
- Sort by
oldest newest most voted
0
OK, from "read the html", it sounds as if you want to see the HTML documents that were downloaded (or uploaded).
Wireshark should show you the entire HTML document in the packet details window - there should be a "Line-based text data: text/html" entry below the "Hypertext Transfer Protocol" entry - but, if you want to get the HTML into a file, "use Wireshark to extract http objects from a capture" might work.
Open the capture file with Wireshark and select File > Export Objects > HTTP.... That should show a window with a list of packet numbers, host names, content types, sizes, and file names. Select one of them and click "Save"; it should give you a file dialog that lets you select where to save the file (HTML, GIF, JPEG, etc.).
Your Answer
Please start posting anonymously - your entry will be published after you log in or create a new account.
This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.
Comments
Can you rephrase your question, it doesn't seem to make any sense? Are you saying that you want to use Wireshark to extract http objects from a capture?
So:
The answer will probably depend on the answers to both of those questions.
I have been given a capture file which contains several packets which i believe are html. I need to find information from inside the files- some of which is readable from the packet details and some isn't. I can't work out how to open the packets and properly read the html inside.
If you are new to wireshark, you may be better off extracting the data you are looking for with Network Miner. Free edition should work for you, please take a look at netresec.com