Wireshark · Ethereal-users: Re: [Ethereal-users] Microsoft Word Document

[Guy Harris <gharris@xxxxxxxxx>]

Mike Philip wrote:
> How do you reconstruct a MS Word document captured via
> ethereal?

How was it transferred?

If it was transferred over HTTP, then (at least if it's not so big that 
Ethereal runs out of memory) you could enable reassembly of HTTP headers 
and bodies (see the preferences for HTTP - and also the preferences for 
TCP, as you have to enable reassembly of protocols running atop HTTP), 
you could select the HTTP body and use File -> Export -> Selected 
Bytes... to save the data in the HTTP body.