Extracting JPEG Images from the network (Wireshark)
We work with image formats like JPEG all the time—for example, when uploading pictures to a server, downloading them from the internet, or sending photos to friends through email and other platforms.
Using Wireshark, we can easily monitor our network traffic and see who is sending or receiving image files across the network. This is especially useful for analyzing data transfers and understanding how files move over HTTP or other protocols.
Below is a sample capture that includes JPEG images. While you may not immediately see the image packets, they will become visible once we apply the appropriate filters in Wireshark.
Once you apply the filter command, you'll see results similar to the example below—showing only HTTP traffic that contains JPEG image content.
Keep in mind that JPEG files can be transferred using various protocols—not just HTTP. As mentioned earlier, if a JPEG was sent over the network using an application like FileZilla, you would see FTP (File Transfer Protocol) listed under the "Protocol" column in Wireshark. However, in our example above, the image was downloaded from the internet, which is why you see HTTP as the protocol.
Next, select the first packet and then click on JPEG tab in the middle pane.
Right click JPEG and then click "Export Packet Bytes".
This will open File Explorer, allowing you to save the file to any location on your system. Just make sure to save it with a .jpg extension—otherwise, the operating system may not recognize it as an image file.
Here is the final image you will get.
There is also another method to extract images from the capture.
If you click on the File menu in the top-left corner of Wireshark and choose Export Objects, you'll see a list of available protocols. From there, select HTTP to view and export all objects—such as images—that were transferred over HTTP during the capture.
This will open the Object List, where you can find all related objects from the capture—such as JPEG images, PNG files, executable files, and more.
You can filter and see only the jpegs.
You can then select the file you want to extract and then hit save.
This will once again open File Explorer, allowing you to save the file to any location you choose. Unlike the first method, you don’t need to manually type .jpg—Wireshark already recognizes the file type and labels it as a JPEG.
In our first method, the exported file was in raw byte format, and it was the operating system that interpreted it as a JPEG when we added the .jpg extension.
(but here it won't hurt even if you type bg2.jpg, you will still get the same result).
I’d also like to dive deeper into how JPEG files are actually transferred over the network, but to keep this blog concise, I’ll save that for a separate post. In that follow-up, I’ll briefly explain what happens behind the scenes when images like JPEGs are sent or received over various protocols.
Hopefully, this all makes sense. Feel free to let me know if I missed anything or if you notice any mistakes—I'm always open to feedback.
Comments
Post a Comment