Re: Removing HTTP headers from tcpdump logs

From: George W. Capehart (gwcat_private)
Date: Wed May 07 2003 - 14:23:39 PDT

  • Next message: shawnmer: "Re: Removing HTTP headers from tcpdump logs"

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    On Wednesday 07 May 2003 12:20 pm, Jarkko Turkulainen wrote:
    > > My question to the list: What tools/methods are used to manually
    > > remove the HTTP headers that prevent the (easy/quick) recovery of
    > > files over HTTP?
    >
    > Text editor! I use the vi editor to edit the TCP session file. Just
    > "dd" the headers and the emtpy line after them, and the file is ready
    > for recovery. tar might give a warning because of the extra carrier
    > return character in the end of the file, but it really works!
    
    If it's a big file, or if you have several, awk or Perl might be more 
    efficient . . .
    
    /g
    - -- 
    George W. Capehart
    
    "With sufficient thrust, pigs fly just fine . . ."
     -- RFC 1925
    
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.6 (GNU/Linux)
    Comment: For info see http://www.gnupg.org
    
    iD8DBQE+uXl1PhMbfSg3fpARAinzAJ45Ofe0YG2vAhfBZ9DaQZbfXquPIwCcCG8V
    uACExKmM5vVxwenXY0VawZ8=
    =WVA6
    -----END PGP SIGNATURE-----
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu May 08 2003 - 14:59:35 PDT