0

I have captured some traffic with Wireshark and saved the result as a file. The file has 3 sections now:

  1. request headers
  2. response headers
  3. response body

The response body is to become an flv file, but now everything is saved as a single file. So I need a way to delete the first two sections from the file, but the problem is that the file is very big (over a thousand mega bytes). I have tried to open it with gedit, but no matter how long I wait, gedit hangs and remains unresponsive until I kill it.

What tool can I use to edit this big file easily?

  • Did you try with command line text editors? nano or vim? – Savvas Radevic Jun 24 '12 at 14:06
  • @medigeek - I am very clumsy with command line tools, but I'd give it a shot. – Majid Fouladpour Jun 24 '12 at 14:10
  • This seems like a convoluted way to steal a flash video – tgm4883 Jun 24 '12 at 14:15
  • 1
    @tgm4883 - It may seem so, but it's not. – Majid Fouladpour Jun 24 '12 at 14:23
  • 1
    There! Another Inspector Javert! @tgm4883 The original problem resulting in this question being posted has been dealt with -- in Windows and with Notepad++. If you are eager to help though, the question is still there; let us all indulge in your knowledge! – Majid Fouladpour Jun 24 '12 at 22:42
1

I doubt if Wireshark output that I am assuming to be a pcap file can be "nicely" divided into sections like request, response and body. The file would be a sequence of packets containing everything captured from the link layer onwards each prepended by a Wireshark header. Decoding the session that contributed to the transfer of say a big video file will require analyzing headers from the network protocol stack like IP, TCP and HTTP and combining the application level payload (e.g., HTTP).

  • I'm giving this a +1. There should be a "Follow TCP stream" in wireshark.. or something to make things easier... – Savvas Radevic Jun 24 '12 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.