Hi,
I am trying to learn how to extract transferred files from pcap dumps.
I have a pcap file with an http data transfer that is gzip-encoded ("Accept-encoding: gzip,deflate" in the http header). I tried selecting and exporting the data portion of the two packages that seemed to be part of this transfer and then concatenate them, but when I try to gunzip it, I get "unexpected end of file." Using Network Miner, the file decodes just fine.
I would like to learn how to do this using only Wireshark - does anyone know of a good guide on how to do this in Wireshark?
Thanks,
JB
|