Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am attempting to analyse my WiFi network with on Mac OS X, is there a tool to reassemble TCP stream from Wireshark capture. I would like to see the entire HTML pages that are passing through the WiFi

share|improve this question

closed as off topic by Adi, AJ Henderson, TildalWave, NULLZ, Rory Alsop Jun 3 '13 at 20:49

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

I use justniffer_grab_http_traffic. Very easy and straightforward. –  Adi Jun 3 '13 at 12:56
For HTTP you can use httpry which is based on libpcap as well, but only focuses on HTTP traffic. –  0xC0000022L Jun 3 '13 at 14:59
@Adnan thank you but it is not mac compatible... –  Newben Jun 3 '13 at 18:36
@Newben It is. Just download the source and compile it. If you want something that is compiled and ready for Mac OS X, you can use Bro. –  Adi Jun 3 '13 at 18:51
OK thank you, I am going to try it ;) –  Newben Jun 3 '13 at 19:05

1 Answer 1

You should be able to just right click on any HTTP packet and select "Follow TCP Stream" which will rebuild the page. You could select the "Save As" and save it somewhere, e.g.: "captured-page.html"

Edited to add more:

Here is the walk through on Wireshark: http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowTCPSection.html Your other option is to use tcpflow: tcpflow -r http.cap

share|improve this answer
thank you, but when I right click on any packet, nothing happens. Btw, the captured-page.html appears in an non readable ascii format –  Newben Jun 3 '13 at 18:44
thank you very much, but the problem is that when I open the caputured-page.html, I get some non readable text with raw caracters... –  Newben Jun 4 '13 at 11:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.