Search code examples
pythonc++network-programmingtcpdump

How to recreate a file using tcpdump and c++?


I have the pcap file for duration when the text file was downloading. How can I recreate the original file from this pcap file using python or c++. I don't know much about network programming and am trying to do this to enhance my understanding. Any help is appreciated.


Solution

  • This depends on what the pcap file looks like. Assuming that the text file is in the data field inside of the tcp layer, you can use tshark like so:

    $ myfile="traffic.pcap"
    $ tshark -r $myfile -T fields -e data > myfile.txt
    

    If data is not the right field, use wireshark to look at the packets to see which is. If the data is actually encrypted (which is pretty common with HTTPS, SSH, etc.), then this is a different question.

    With this strategy, you may also get extraneous data from other traffic (you may need to use a display filter on the pcap file for the traffic you're interested in so you just have the text file encapsulated with network headers for easier export).