2

I am attempting to analyse my WiFi network with on Mac OS X, is there a tool to reassemble TCP stream from Wireshark capture. I would like to see the entire HTML pages that are passing through the WiFi

closed as off topic by Adi, AJ Henderson, TildalWave, NULLZ, Rory Alsop Jun 3 '13 at 20:49

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I use justniffer_grab_http_traffic. Very easy and straightforward. – Adi Jun 3 '13 at 12:56
  • For HTTP you can use httpry which is based on libpcap as well, but only focuses on HTTP traffic. – 0xC0000022L Jun 3 '13 at 14:59
  • @Adnan thank you but it is not mac compatible... – epsilones Jun 3 '13 at 18:36
  • @Newben It is. Just download the source and compile it. If you want something that is compiled and ready for Mac OS X, you can use Bro. – Adi Jun 3 '13 at 18:51
  • This isn't really a security question - it is simply requesting info on how to use a networking tool. Best answered by looking at the large amount of online documentation and walkthroughs for wireshark. – Rory Alsop Jun 3 '13 at 20:50
3

You should be able to just right click on any HTTP packet and select "Follow TCP Stream" which will rebuild the page. You could select the "Save As" and save it somewhere, e.g.: "captured-page.html"

Edited to add more:

Here is the walk through on Wireshark: http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowTCPSection.html Your other option is to use tcpflow: tcpflow -r http.cap

  • thank you, but when I right click on any packet, nothing happens. Btw, the captured-page.html appears in an non readable ascii format – epsilones Jun 3 '13 at 18:44
  • thank you very much, but the problem is that when I open the caputured-page.html, I get some non readable text with raw caracters... – epsilones Jun 4 '13 at 11:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.