I have both windows and linux available.
The problem I have had with ngrep and perl is that it is easy to match the first TCP packet of the POST, however, to continue grabbing the remainder of the TCP packets (and data) associated with that POST request, I need something that is "aware" of the TCP session.
I was trying to avoid having to write session handling routines, etc.
Obviously if assniff is able to reconstruct files, it is able to reconstruct the TCP session. I was hoping to be lazy and just be able to stream the data right out of that without having to reinvent the wheel.
|