From owner-freebsd-questions@FreeBSD.ORG Sat Jul 10 05:18:10 2010 Return-Path: Delivered-To: questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 716E7106564A for ; Sat, 10 Jul 2010 05:18:10 +0000 (UTC) (envelope-from modulok@gmail.com) Received: from mail-qy0-f175.google.com (mail-qy0-f175.google.com [209.85.216.175]) by mx1.freebsd.org (Postfix) with ESMTP id 2DA358FC13 for ; Sat, 10 Jul 2010 05:18:09 +0000 (UTC) Received: by qyk30 with SMTP id 30so765017qyk.13 for ; Fri, 09 Jul 2010 22:17:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:date:message-id :subject:from:to:content-type; bh=7u1NVeVGRjMYdcPGdMpOFkUBVwGjpF7FxtZ4DxbC5U4=; b=OJOTmobOg3dd/4WExygkFH65MtN4PkIWKJY/uPMqaev43Qoa/AX44XKcUxJ1m30jwV y0swQ0hheJUTl7vXmqxWjK7UIqZ5JQzpBKpTc01VjvmWOfRT5Zaq8p/NPs22ijBc5qR8 t96Vp9MizrIPzrVYr1h7D2PrKxO/Acm/av0Ew= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=RaqIYqm073VPy8CVkXvraspGbXM6c0kBhoy9GWN688St69vhRFi5LlHUFS0tOw+A2A eoMGomZanM5sxM9PG31z81xOIz8Yis9v7Wox3KcfVEBW0nwrorl0Gc2XcWzvrrq8Te/x LEf7wVd5ixQG1dU4AEBmB3K5WvkiEziNU1gjU= MIME-Version: 1.0 Received: by 10.224.2.147 with SMTP id 19mr6192437qaj.58.1278739075702; Fri, 09 Jul 2010 22:17:55 -0700 (PDT) Received: by 10.224.67.132 with HTTP; Fri, 9 Jul 2010 22:17:55 -0700 (PDT) Date: Fri, 9 Jul 2010 23:17:55 -0600 Message-ID: From: Modulok To: "questions@freebsd.org" Content-Type: text/plain; charset=ISO-8859-1 Cc: Subject: Reconstruct meaningful data from tcpdumps? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Jul 2010 05:18:10 -0000 Is there a way to reconstruct network traffic from a tcpdump file? Or something similar? As in: analyze the dump file and attempt to re-construct files transfered though http, ftp, known messenger protocols, instant message conversations, http requests, web pages, and so forth? There's a bunch of tools on Windows that say they do this to some extent or another, but they require a client-side installation, cost a lot of money, or are crawling with malicious code. I can read tcpdump files, (to an extent) but viewing a hex dump of a jpeg is futile. If that makes any sense. Thanks guys!