Ask Your Question

Revision history [back]

Tshark truncate packet data with binary png image, how to prevent?

Hey guys :) I captured with wireshark some http traffic which contains getting a simple web page html content, and a little png type photo. Till here, everything is good!

Now, I wanted to print all the actual content of the responses (two responses - html page, and a photo), so I used the next tshark command:

tshark -nr <pcap file> -T fields -e http.file_data

well, the output seems pretty fine at the beginning, because I can see the actual content of the web page I got, but when I continue wathing the output I noticed that the png image was truncated and only printed some weird character and then the word PNG - after that, the output ended without even printing the actual binary content of the image.

How can I print the content even if it is in a binary format like the PNG was? I don't care printing it all in hex format, but somthing! Thanks guys...