How can you extract downloaded HTTP objects (files) from a capture?

• A. Statistics > Protocol Hierarchy to save files.
• B. Analyze > Export Objects > HTTP to save files.
• C. Conversations > TCP to extract files.
• D. Export Objects > DNS to save files.

Answer: (B)

Extracting downloaded HTTP objects is about pulling the actual files that were transferred in HTTP responses. The method you want uses the HTTP export feature in Wireshark: Analyze > Export Objects > HTTP. This opens a list of all HTTP objects in the capture, showing details like host, path, and file size, and lets you save one or all of the objects to disk. It works because the HTTP dissector reassembles the response bodies from the captured traffic, so you can recover the transmitted files directly. This only works for unencrypted HTTP; for HTTPS, the payload is encrypted unless TLS decryption keys are available. Other menus, like Protocol Hierarchy, Conversations > TCP, or DNS export, aren’t designed to extract HTTP object files.