Exporting packets, bytes, and objects

Instead of saving an entire file, you may want to save only a portion of the file or even just the objects found within the file. Within this section, you'll find several export options:

  • Export Specified Packets: This provides a wide range of options that include only displayed packets, a range of packets, and marked packets, as shown here:

The Export Specified Packets dialog box
  • Export Packet Dissections: This offers many choices to export, as shown in the screenshot, including CVS, plaintext, and JSON:

The Export Packet Dissections menu
  • Export Packet Bytes: This feature exports the packet bytes into C arrays so you can import the stream into a C program.
  • Export PDUs to File: This menu choice offers many selections to export; however, this feature may not show a usable output and may only work with specific applications.
  • Export TLS Session Keys: If there are session keys within the file, select this option to export the keys that can be used to decrypt the data. Wireshark will display a popup if there are no TLS (short for Transport Layer Security) keys to save.
  • Export Objects: This exports objects found within the file, such as images, documents, and executables. For frame 36, select Export Objects | HTTP, which will display a list of objects found, as shown here:

The Export Objects—HTTP dialog box

Within this window, you can select Save, Save All, or even use the Text Filter:

The Export Objects—Save As dialog box

I selected Save and then navigated to a temporary folder, Export. For the filename, I selected logo.png. I included the extension to ensure the object is saved in the correct format. When done, navigate to the folder and open the image and you should see the Packet Life logo.

 If there are other objects within the capture, you can save them in a similar manner.

As you can see, there are many ways to export components in Wireshark. In the lower part of the File menu, we see options to print and quit, which we'll evaluate next.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.142.96.146