File Extraction

[lovejotd]

I was wondering is it possible to use sharppcap to extract files from pcap? For example, images or other files via ftp. Thanks!

[kayoub5]

@chmorgan I think this question should be addressed/moved to https://github.com/chmorgan/packetnet-connections

[chmorgan]

@kayoub5 @lovejotd yep. packetnet-connections can follow tcp connections and decode http. I think there are some examples showing how to get web pages downloaded or something in there. You'd have to add a protocol dissector for ftp transfers though.

[lovejotd]

Do you have any examples of this? Or anything? Also, does it work with pcap files? Thanks!

[chmorgan]

https://github.com/chmorgan/packetnet-connections has some screen recordings of the examples and other info, examples are in the examples folder.

…

On Sat, Sep 25, 2021 at 4:19 PM lovejotd ***@***.***> wrote: Do you have any examples of this? Or anything? Thanks! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#326 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJH4AEBC7XMXTJ6ESBJJZDUDYVGTANCNFSM5EVBKDLQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[lovejotd]

So I dont see in any of the examples actually getting the file from the data received. When I try to do this, the e.request.body in my handlers is always null (never any data), although much of the other data is filed in. Should this be the case? Is this something I need to track myself? Thanks!