Finding Downloaded Files In .pcap File
I am looking through a packet capture (.pcap) file, trying to find 4 files downloaded from an FTP server, but haven’t been able to find them. I have tried many online tools, but am unable to use Wireshark, tcpick, and tcpxtract. Any help would be awesome, or any other tools I can use to find them. I’m using Ubuntu Version 18.
You can use Wireshark. After installing Wireshark open the .pcap file in wireshark and follow the steps:
Filter ftp-data by typing in above pane and press enter.
Now Right click on FTP filter data stream showing and click Follow > TCP Stream
Now in the new window that open Change Show and save data as Raw click Save as... and save the file with your desired name.