0
votes

In the promiscuous mode, using tcpdump (Wireshark helps to view the packet in Hex format), I can view different packets (not complete meaningful data) requested and obtained my different devices connected to the WiFi router.

But How can I reassemble all packets for a particular device IP in order to get the meaningful data those are requested and obtained by that device?

Are there any existing solutions available?

1
Yes. Wireshark and many other tools. However, this question is in appropriate for SO. - David Hoelzer
From Wireshark, I can't extract the meaningful data. Suppose one of my devices is sending some video file to my one another device. After sniffing, how to get the exact video file? Wireshark can show fragmented packets in Hex format. Can you please mention some other names from many other tools? - MSD Paul
Try looking at the menus. Analyze -> reassemble TCP stream - David Hoelzer

1 Answers

0
votes

As David Hoelzer suggests, you will first need to ensure that TCP reassembly is enabled. Most likely it already is, but you can verify this via "Edit -> Preferences -> Protocols -> TCP -> Allow subdissector to reassemble TCP streams". In case there's IP fragmentation occurring, you should also verify that IP reassembly is enabled as well: "Edit -> Preferences -> Protocols -> IPv4|IPv6 -> Reassemble fragmented IPv4|IPv6 datagrams".

But this isn't the whole story, as this won't extract complete files (objects) for you. Wireshark does support the extraction of objects for some protocols though, specifically DICOM, HTTP, IMF, SMB and TFTP, via the "File -> Export Objects" feature. So, if your file is being transported over one of these protocols then you're in luck and stand a chance at extracting it using Wireshark; otherwise you'll have to find another tool besides Wireshark that's capable of extracting the object from the packets.

See https://www.wireshark.org/docs/wsug_html_chunked/ChIOExportSection.html#ChIOExportObjectsDialog for more details about exporting objects.

See https://wiki.wireshark.org/Tools for other possible tools that may be of interest to you in the event that Wireshark fails to meet your needs.