[help]How t view size of a file in wireshark


#1

Hello,our proffessor asked us to find the size of a file downloaded from a site using wireshark…can you tell me how to do this?obviously i could count the packets manually but is there a way or a function in wireshark to do that?


#2

Downloaded by HTTP ?
HTTP header of the answer should contains a field “Content-Length” which gives the length of the data.

Downloaded by another protocol over TCP ?
Look at “Sequence number” of TCP.
Size of TCP data = Last “Sequence number” + last packet Size - First “Sequence number”

Data could be zipped or encrypted.

Olivier