[Keith Roberts <keith@xxxxxxxxxxxx>]

Hi Joke.

It's actually not that hard at all. Please see this youtube 
video.

http://www.youtube.com/watch?v=U6ZveV0nDpk

I've pulled out 2 SMTP emails, and 1 has the rar file.

You CAN save all the data at once from the Wireshark GUI.

Kind Regards,

Keith

On Sun, 25 Dec 2011, j.snelders wrote:

> To: Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>
> From: j.snelders <j.snelders@xxxxxxxxxx>
> Subject: Re: [Wireshark-users] Learning Wireshark
>
> Hi Keith,
>
> Please first try NetworkMiner.
> Those links are just additional information; sorry for the noise.
>
> Wireshark - "Export Selected Packet Bytes":
> - select "Media Type"
> - right-click and select "Export Selected Packet Bytes"
> - next convert
> Still a lot of work...
>
> Hope this helps
> Joke
>
>
> On Sun, 25 Dec 2011 14:11:44 +0000 (GMT) Keith Roberts wrote:
> > On Sun, 25 Dec 2011, j.snelders wrote:
> >
> > > To: Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>
> > > From: j.snelders <j.snelders@xxxxxxxxxx>
> > > Subject: Re: [Wireshark-users] Learning Wireshark
> > >
> > > Hi Keith,
> > >
> > > Try NetworkMiner by NetreseC:
> > > http://www.netresec.com/?page=NetworkMiner
> > >
> > > Interesting links:
> > > http://support.jodohost.com/showthread.php?t=11351
> > > http://www.motobit.com/util/base64-decoder-encoder.asp
> >
> > I've tried something similar to this Joke, but I want to get
> > all the Base64 data for a rar file in one go from a pcap
> > file. I think manually copying and then pasting Base64 into
> > the web form could be very awkward, and prone to introducing
> > errors.
> >
> > How can I pull the Base64 data for a rar file from a pcap
> > file at one time? Then I could upload it and try to convert
> > in -- unless there is a CLI application to do this?
> >
> > Kind Regards,
> >
> > Keith
>
>
>
>
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe

--
-----------------------------------------------------------
Websites:
http://www.karsites.net
http://www.php-debuggers.net
http://www.raised-from-the-dead.org.uk

All email addresses are challenge-response protected with
TMDA [http://tmda.net]
-----------------------------------------------------------