extract file from FTP stream with tshark

edit

Thank you! But how to output raw data to file to get the copy of original file?

The above command will get you raw data. Redirect it to a file or pipe it to another processor.

Not exactly. Lets say i do:

tshark -r d14.pcap -z follow,tcp,raw,213.183.48.117:59642,172.18.86.24:42938 > f

then file "f" contains packets statistic and then some data in hex. How can I get the file data from it to get the copy of original file, like it is done with Wireshark after "save as.." command?

Add the -q flag to suppress the "normal" output and then post-process it. See this answer from the old site.

Thank you for help! xxd did the trick!