210-255 · Question #51
Which option allows a file to be extracted from a TCP stream within Wireshark?
The correct answer is A. File > Export Objects. Wireshark's 'File > Export Objects' feature allows analysts to reconstruct and save files transmitted over protocols such as HTTP, SMB, and DICOM from a captured TCP stream.
Question
Which option allows a file to be extracted from a TCP stream within Wireshark?
Options
- AFile > Export Objects
- BAnalyze > Extract
- CTools > Export > TCP
- DView > Extract
How the community answered
(43 responses)- A91% (39)
- B2% (1)
- C2% (1)
- D5% (2)
Why each option
Wireshark's 'File > Export Objects' feature allows analysts to reconstruct and save files transmitted over protocols such as HTTP, SMB, and DICOM from a captured TCP stream.
The 'File > Export Objects' menu in Wireshark provides the ability to extract and save files transferred within captured network streams, including HTTP, SMB, IMF, DICOM, and TFTP objects. This is the only built-in Wireshark feature that reassembles and exports application-layer objects from packet captures. It is commonly used by analysts to recover files transmitted over the network for further forensic analysis.
There is no 'Analyze > Extract' menu option in Wireshark - the Analyze menu is used for display filters, expert info, and protocol decoding.
There is no 'Tools > Export > TCP' menu path in Wireshark - the Tools menu provides options like Lua scripting and credential extraction, not file export.
There is no 'View > Extract' menu option in Wireshark - the View menu controls display preferences such as columns, coloring rules, and packet layout.
Concept tested: Wireshark file extraction from captured network streams
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChIOExportSection.html
Topics
Community Discussion
No community discussion yet for this question.