Linux Tools For Extracting Files From Pcap Files

[bowler]

Hi,

in episode 902 of hak5, snubs does a walkthru of the CCC challange for Feb 27. One of the tools used was networkminer. She was able to extract a file from a pcap file called kerberos.jpg using networkminer. The file came out perfectly fine. I have not tried networkminer myself but am sure that I would get the same results.

However I tried using linux tools such as foremost, tcpxtract, dsniff suit to carry out the same funtion. But when I look at the kerberos.jpg file for example its corrupted. See the attached pic to see what I mean.

My question is are there any reliable linux tools for parsing a pcap file and dumping any files found. Foremost and tcpxtract seem to do a good job of the parsing bit, but as from seen here somehow the pics are corrupted.