Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any tool to extract cookies from network sniffs generated by tcpdump (.pcap files).

I know I can open it in wireshark but it will take a while until I find the domain I am interested into and the cookies (is there a filter I can use ?)


share|improve this question haven't used it myself but looks it will do what you looking for – Sachin Kumar Apr 5 '13 at 14:02
have you tried firesheep? – rook Apr 5 '13 at 15:45

It looks like you should be able to easily pull the cookies from your pcaps with Wireshark or tshark using filters based around HTTP Cookies.

You should be able to match against http.cookie as a string according to the filters protocol reference:

Some more general information about filter syntax (including operators) is here:

I'd fire up Wireshark on your pcap and use Find Packet with a known string and then use the right click menus to have Wireshark craft the filter for you (as described some in the manual section 6.2.2. Pop-up menu of the "Packet List" pane at

You can then use that filter (copy and paste) in a console with tshark to rapidly search large pcaps or script the searches trivially.

share|improve this answer
A tshark command that will filter on packets with cookie and display the host and cookie: tshark -r some.pcap -T fields -e -e http.cookie -Y http.cookie (note: perhaps the field will be empty for server-originated cookies (responses from the server)). – Lekensteyn Apr 2 '14 at 20:16

The best solution is probably to load the PCAP file into NetworkMiner. All cookies will be automatically extracted by NetworkMiner and displayed on the "Credentials" tab.

This has already been suggested at the Wireshark-users mailing list:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.