How to see files downloaded length in wireshark

Introducing Content Health, a new way to keep the knowledge base up-to-date. Podcast what if you could invest in your favorite developer? Featured on Meta. Now live: A fully responsive profile. Reducing the weight of our footer. Linked 0. Related Hot Network Questions. Question feed. The file command returns the type of file. The shasum command will return the file hash, in this case the SHA file hash.

Figure 5. Determining the file type and hash of our two objects exported from the pcap. The information above confirms our suspected Word document is in fact a Microsoft Word document. It also confirms the suspected Windows executable file is indeed a Windows executable. We could also do a Google search on the SHA hashes to possibly find additional information. In addition to Windows executable or other malware files, we can also extract web pages. Our second pcap for this tutorial, extracting-objects-from-pcap-example When reviewing network traffic from a phishing site, we might want to see what the phishing web page looks like.

Then we can view it through a web browser in an isolated environment as shown in Figure 7. Figure 6. Exporting a fake PayPal login page from our second pcap. Figure 7. The exported fake PayPal login page viewed in a web browser. A banking Trojan known as Trickbot added a worm module as early as July that uses an exploit based on EternalBlue to spread across a network over SMB.

We continue to find indications of this Trickbot worm module today. Our next pcap represents a Trickbot infection that used SMB to spread from an infected client at The pcap, extracting-objects-from-pcap-example Open the pcap in Wireshark. Figure 8. Getting to the Export SMB objects list. Figure 9. The export SMB object list. A closer examination of their respective Filename fields indicates these are two Windows executable files.

See Table 1 below for details. Table 1. In the Content Type column, we need [ Any number less than percent indicates there was some data loss in the network traffic, resulting in a corrupt or incomplete copy of the file. First capture the traffic , then find your HTTP traffic, right click one instance, go to Protocol Preferences and make the following are checked:.

Clicking it makes Wireshark skip to the packet number in the output. But what if you actually wanted to see that image? Can you do that in Wireshark? If you wanted to find out the exact user who downloaded this file just open the Ethernet Frame and look at the MAC address. All you need are the last four digits of the MAC. You can do the same trick with video. How to find size of file downloaded? I am looking for a step by step demo to know how to find the size of file downloaded. Hi, This will be difficult because www.

You would see the size in KB for your file. You can always "eyeball it" by using "Follow TCP. This data is encrypted but Wireshark does calculate the size of this "conversation.

It won't be equal the exact size of your file because of the packet headers. This will more or less precisely give you the size of all the packet headers.