# Following Streams & Object Extraction

When an attacker downloads malware via HTTP, or an employee uploads a confidential PDF via FTP, that data is split into hundreds of separate TCP segments. Looking at one packet at a time is useless for understanding the "big picture."

## Follow TCP Stream
This is arguably Wireshark's most powerful feature for reconstructing events.

If you right-click a packet that is part of a larger conversation (like an HTTP GET request) and select **Follow -> TCP Stream**, Wireshark performs magic:
1.  It automatically figures out the source/dest IPs and ports.
2.  It reassembles all the fragmented packets in the correct order.
3.  It strips away all the OSI headers (MAC, IP, TCP headers).
4.  It presents you with a clean text window showing *only* the application layer data.

**Reading the Stream:**
*   Text colored **Red** represents data sent from the Client to the Server (e.g., the browser asking "GET /index.html").
*   Text colored **Blue** represents data sent from the Server to the Client (e.g., the server replying "200 OK" and the HTML code).

*Note:* If you "Follow" a stream of an encrypted protocol like HTTPS or SSH, you will just see gibberish characters, because the payload is encrypted.

## Extracting Objects
If you can see a file (like an image, a PDF, or an .exe) being downloaded over an unencrypted protocol (HTTP, FTP, SMB), Wireshark can carve that file right out of the PCAP and save it to your hard drive so you can analyze it.

**How to Extract (HTTP):**
1.  Go to **File -> Export Objects -> HTTP...**
2.  Wireshark will open a window listing every single file transferred over HTTP during the entire packet capture.
3.  It lists the Packet Number, Hostname, Content Type (e.g., `image/png` or `application/x-msdownload`), and the Filename.
4.  You can select a suspicious file and click **"Save"** to put it on your Desktop. You can then submit that file to VirusTotal or analyze it in a sandbox.

This is a critical skill for extracting malware payloads that defense sensors may have missed, but the packet capture recorded.