Network Sniffing Cap File - Notes

cat net.cap #RAW data - might need 'reset' terminal
strings net.cap #view strings
strings net.cap|grep hqdefault
strings net.cap|grep hqdefault |sed 's/GET /\n/g'|grep ^\/vi|awk '{print $1}'|sort -u|while read jpg;do echo "http://i3.ytimg.com/$jpg" ;done

strings net.cap|grep hqdefault |sed 's/GET /\n/g'|grep ^\/vi|awk '{print $1}'|sort -u|while read jpg;do wget -c "http://i3.ytimg.com/$jpg" -O jpg/$RANDOM.jpg;done

photorec net.cap #part of testdisk package -- we get more with 'strings'
foremost net.cap #works but files corrupt = fragmentation?
wireshark net.cap #File -> Export Object -> HTTP