Quick and dirty packet capture data extraction

If you ever find yourself needing to reconstruct binary data contained within a packet capture, there is a simple way to do so on the fly using only Wireshark and a utility called foremost. Reference the attached packet capture containing a JPEG image downloaded via HTTP to play along.

Step 1: Isolate the desired data stream

This is most easily done by selecting a packet within the stream containing the data you want to extract and selecting "Follow TCP (or UDP) Stream" from the right-click context menu.

Wireshark applies a display filter to the packet list so that only packets from the selected stream are shown, and it invokes the stream content window shown below.

Step 2: Extract raw unidirectional data

Wireshark marks transmitted and received data in red and blue, respectively. For the purpose of this example, we're only interested in the received data, so we restrict the stream parser to show only inbound (blue) packets by selecting that direction from the option at bottom.

Now to extract this data. Ensure that the Raw option is selected and click Save As to export the binary data. For our example, I've saved the dump to disk as "example.raw".

Step 3: Data carving with foremost

What we have now is an HTTP response and a JPEG image smooshed together in a single binary blob; this isn't of much use.

$ file example.raw
example.raw: data

We can use the foremost forensics utility to sift through this blob and extract any recognizable binary data structures (e.g. a JPEG image).

$ foremost -v -i example.raw
Foremost version 1.5.5 by Jesse Kornblum, Kris Kendall, and Nick Mikus
Audit File

Foremost started at Sun Jul 12 15:59:27 2009
Invocation: foremost -v -i example.raw 
Output directory: /home/stretch/test/output
Configuration file: /etc/foremost.conf
Processing: example.raw
|------------------------------------------------------------------
File: example.raw
Start: Sun Jul 12 15:59:27 2009
Length: 30 KB (31185 bytes)

Num  Name (bs=512)         Size  File Offset     Comment

0:  00000000.jpg          30 KB             330
*|
Finish: Sun Jul 12 15:59:27 2009

1 FILES EXTRACTED

jpg:= 1
------------------------------------------------------------------

Foremost finished at Sun Jul 12 15:59:27 2009

foremost dumps its findings to a directory named output:

$ ls output/
audit.txt  jpg
$ ls output/jpg/
00000000.jpg
$ file output/jpg/00000000.jpg
output/jpg/00000000.jpg: JPEG image data, JFIF standard 1.01

Filenames are assigned as serial identifiers because foremost has no knowledge of their original names, but the data is intact.

There are, of course, more elegant ways to do this, but this simple method is handy when on-the-run or manual one-off analysis is necessary. Some other (open source) tools to check out are:

• NetworkMiner (Windows)
• tcpxtract
• tcpflow

(Thanks to Dave Hull, from whom I shamelessly stole this idea.)

Update

Jeremy L Gaddis pointed out that Wireshark has the (limited) ability to extract data on its own, demonstrated nicely in these two videos: JPEG from the example and a PDF. (Note that foremost may still be necessary for extracting data from protocols other than HTTP.)

Also, Sebastien Raveau suggested tcpflow, which I've added to the list of suggested tools above.

Thanks guys!