An rtf file was transferred as FTP-DATA, so I followed the TCP Stream and saved the file. How can I decode this to view the contents?

edit

Wireshark does not yet support "File -> Export Objects" for FTP data transfers, but you should be able to export the data anyway if you follow this guide:

1. Select the packet where you see the rtf file of interest indicated in the Info column
2. In the Packet List Pane, right-click the packet and choose, Follow -> TCP Stream A new window will appear whose contents contains the 2-way data being transferred.
3. Optional: To be sure you only get the data coming from the FTP server, choose the appropriate direction of data flow instead of Entire conversation. There should only be data flowing in one direction, so if that's the case, then this step isn't necessary.
4. Next to Show and save data as, be sure to select Raw
5. Select *Save as..." at the bottom and give it a name, e.g., file.rtf.

You should now have the rtf file. If desired, repeat for the text file or any other transfers.