NETRESEC Network Security Blog - Tag : tcpflow

rss

Comparison of tools that extract files from PCAP

One of the premier features in NetworkMiner is the ability to extract files from captured network traffic in PCAP files. NetworkMiner reassembles the file contents by parsing protocols that are used to transfer files across a network.

But there are other tools that also can extract files from PCAP files, such as Wireshark and Zeek. The file extraction support in these alternative solutions sometimes complement and sometimes overlap with that of NetworkMiner. Either way it is good that there are multiple tools that are designed to perform the same task. This allows us to compare the output from the different implementations, for example if the results from one tool seems strange or is suspected to be incorrect or incomplete.

comparing apple to orange

Tools that can reassemble and extract files from network traffic or PCAP files:

All of these tools can extract files from HTTP and FTP, but when it comes to other protocols the support varies. The following table summarizes which protocols each tool supports:

Chaos​reader Network​Miner Suri​cata tcp​flow Wire​shark Zeek
FTP
HTTP
HTTP/2
IEC-104
IMAP
LPR
NFS
njRAT
POP3
SMB
SMB2/3
SMTP
TFTP
TLS certs

I’ve been quite forgiving when compiling the table above. Tools are listed as supporting a protocol even if they only work under very specific conditions. I don’t want to name-and-shame any tool, but I strongly recommend that you verify the tools you’re using by comparing what they extract to one or two alternative tools. As an example, some tools only support a few specific commands for the protocol they claim to support. Additionally, some tools only support file extraction in one direction for protocols like HTTP or FTP, even though these protocols are regularly used to download as well as upload files.

Posted by Erik Hjelmvik on Monday, 05 May 2025 16:05:00 (UTC/GMT)

Tags: #Extract#PCAP#NetworkMiner#Suricata#tcpflow#Wireshark#Zeek#FTP#HTTP#IEC-104#IMAP#LPD#LPR#njRAT#POP3#SMB#SMB2#SMTP

Short URL: https://netresec.com/?b=255329f