Wireshark · Wireshark-users: Re: [Wireshark-users] extraction of files from SSL and TCP streams automatically

[Gedropi <gedropi@xxxxxxxxxxxxx>]

Is it possible to have a recent version > 2.4 of tshark separately without upgrading from a Windows package which includes recent versions of Wireshark?  I am limited to Wireshark 1.10.14 for my Window machine but would love to use more recent versions of tshark for the reasons mention in this thread.  Thanks

On Wed, May 9, 2018, at 1:15 AM, Peter Wu wrote:
> On Tue, May 08, 2018 at 08:45:55AM +0000, Miroslav Rovis wrote:
> > So when did Wireshark/Tshark get the ability to extract objects from streams?
> 
> Wireshark has this feature since 2007 as far as I can see. Tshark only
> recently gained this feature (in 2.4 as I said).
> 
> > So what would be the commands to issue, then, on the trace that I offered, and
> > which my stream-cont.pl on streams produced from that trace with my
> > tshark-streams.sh, extracted all the files out from, as I show on that
> > explanation page of mine at:
> > 
> > https://www.croatiafidelis.hr/foss/cap/cap-180505-schmoog-referendum/
> 
> Without reading the whole thing, this tshark command sets the TLS key
> log file, reads the pcap, hides dissection output and saves extracted
> HTTP objects to the "files" directory.
> 
>     tshark -ossl.keylog_file:dump_180505_0342_gdO_SSLKEYLOGFILE.txt \
>         -r dump_180505_0342_gdO.pcap -q --export-object http,files/
> 
> The result is 53 files.
> -- 
> Kind regards,
> Peter Wu
> https://lekensteyn.nl
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    https://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe