Tshark truncate packet data with binary png image, how to prevent?

asked 2020-04-19 17:01:33 +0000

Lonblon gravatar image

Hey guys :) I captured with wireshark some http traffic which contains getting a simple web page html content, and a little png type photo. Till here, everything is good!

Now, I wanted to print all the actual content of the responses (two responses - html page, and a photo), so I used the next tshark command:

tshark -nr <pcap file> -T fields -e http.file_data

well, the output seems pretty fine at the beginning, because I can see the actual content of the web page I got, but when I continue wathing the output I noticed that the png image was truncated and only printed some weird character and then the word PNG - after that, the output ended without even printing the actual binary content of the image.

How can I print the content even if it is in a binary format like the PNG was? I don't care printing it all in hex format, but somthing! Thanks guys...

edit retag flag offensive close merge delete

Comments

Have you looked at the --export-objects option?

$ tshark --export-objects help
tshark: The available export object types for the "--export-objects" option are:
     dicom
     http
     imf
     smb
     tftp
Chuckc gravatar imageChuckc ( 2020-04-19 17:55:42 +0000 )edit