Ask Your Question

Saving, opening, and viewing a .jpg from an TCP stream over FTP

asked 2019-02-07 21:56:34 +0000

updated 2019-02-08 08:02:58 +0000

grahamb gravatar image

Hello everyone,

I need help extracting a jpeg image from a TCP stream. In the capture, the image was sent over FTP, which makes this much more complicated. Here is the text of the TCP stream:

220-FileZilla Server 0.9.59 beta
220-written by Tim Kosse ([email protected])
220 Please visit
502 Explicit TLS authentication not allowed
502 Explicit TLS authentication not allowed
USER admin
331 Password required for admin
PASS goats_123
230 Logged on
250 CWD successful. "/" is current directory.
200 Type set to I
227 Entering Passive Mode (192,168,19,225,243,129)
STOR Cat-inside-Computer.jpg
150 Opening data channel for file upload to server of "/Cat-inside-Computer.jpg"
226 Successfully transferred "/Cat-inside-Computer.jpg"

So as you can see, the file I want to extract and view is called "Cat-insideCumputer.jpg." How do I do this? What file extension do I give the file? How do I just extract data from port 20? Every time I save the stream as a .jpg file, it does not let me view anything. I am doing this on a Windows 10 computer.

So in essence, I'm just trying to look at a jpeg image from an FTP packet capture.

Thank you.

edit retag flag offensive close merge delete



not sure if I can be of any help but try to access your ftp download site with web browser

I started a project to develop plugins for Wireshark to extract video frames, web pages, images and other file formats from saved tcp dump and have played/ opened by a right client


there is no cat inside "Cumputer" ;)


darius gravatar imagedarius ( 2019-02-08 00:23:40 +0000 )edit

Wireshark has an "Export Objects" mechanism, which allows data objects transported over various protocols to be written out to files. Currently, it supports the DICOM, HTTP, SMB, and TFTP protocols (SMB would, I think, only work if a client reads the entire file), and supports exporting anything that is identified as an Internet-format email message ("IMF" - "Internet Mail Format"), so it should handle at least some web pages and images. It doesn't handle individual video frames, and just supports saving them as files, not handing them to programs such as video players or image viewers that read them. It also doesn't handle FTP.

Guy Harris gravatar imageGuy Harris ( 2019-02-08 18:17:01 +0000 )edit

1 Answer

Sort by » oldest newest most voted

answered 2019-02-08 08:14:28 +0000

grahamb gravatar image

FTP uses separate control and data channels, the stream you have shown is the control channel that sets up the data channel near the end with the line 227 Entering Passive Mode (192,168,19,225,243,129) which asks the client to make a connection to the server at IP on port 243 * 256 + 129 which is 62337. If you have captured that stream (it will be from a random port on the client) with a filter ip.addr == and tcp.port == 62337 then you should be able to save that stream as a jpg.

Note the ports used by the server and client will change with each data transfer.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools



Asked: 2019-02-07 21:56:34 +0000

Seen: 61 times

Last updated: Feb 08