Wireshark · Wireshark-users: [Wireshark-users] recontsruct NNTP data

["Karsten Bertens" <kbertens@xxxxxxxxx>]

I would like to reconstruct some avi file send over NNTP.

The file is split into a couple of segments but I got the competed pcap file with all the fragments. I know NNTP uses yenc encoding, the file is yenc encoded and a yenc decoding program does recognize the attachment but still I cant play the avi file.

My avi player keep saying the file is corrupt.

 

I tried a couple of ways to decode this avi but without any solution:

- Used follow TCP stream and loaded this data in the yenc decoder

- even loaded the complete pcap file in the decoder

- tried to cut and paste the data stream and put them into the decoder

 

Like I said without any good results. Does anyone has a good idea to extract this data?

 

Regards,

K Bertens