1

I am looking through a packet capture (.pcap) file, trying to find 4 files downloaded from an FTP server, but haven’t been able to find them. I have tried many online tools, but am unable to use Wireshark, tcpick, and tcpxtract. Any help would be awesome, or any other tools I can use to find them. I’m using Ubuntu Version 18.

DJCZ
  • 11
  • 1
  • 3
  • Without error messages, Ubuntu version, and other details, we don't believe you. Read https://askubuntu.com/help/how-to-ask – waltinator Dec 10 '21 at 16:40

1 Answers1

3

You can use Wireshark. After installing Wireshark open the .pcap file in wireshark and follow the steps:

Filter ftp-data by typing in above pane and press enter.

Now Right click on FTP filter data stream showing and click Follow > TCP Stream

Now in the new window that open Change Show and save data as Raw click Save as... and save the file with your desired name.

Ajay
  • 678
  • 1
  • 5
  • 16