The Big Wide Internets

Sometimes I see a video, song, or other streamed object I want to easily save, but even good firefox plugins can’t rip them. Maybe the video is hard-coded into the swf and there’s no easy way to rip it out, or an online radio station plays a song I like that I want to save for later. But a good firefox plugin can do that right? Sometimes, but not always. A guaranteed way to save everything that comes to you over the wire is simple – rip it straight out of the TCP stream!

Here’s how you do it:

1. Load up Wireshark and start capturing packets.
2. Go to the page with your video/song on it and refresh it, so that your browser will download the media again.
3. Wait for it to fully download, then stop the capture in Wireshark.
4. Save the capture somewhere as a .pcap file. (Your media is in there, now you just have to rip it out).
5. Load it with Network Miner. (File>Open)
6. Click the Files tab. (This shows all of the files that were transferred during the capture, exactly what we want!)
7. Find your file in the list, organizing it by Size makes it easier to find.
8. Right click on it and choose “Open Folder”. This will shows where it was extracted to on your computer.
9. There it is! Copy it somewhere handy and rename it so you know what it is.

The only downfall to this method is that Nework Miner only works on Windows. I’m sure there are probably linux equivalents out there though.

Network Miner can also find other nifty things, like passwords, DNS info, Hosts, and other things. Play around with it, it’s a really nice tool.

Note: This can indeed be used to save songs downloaded by Pandora (or similar sites) for later use. I’m not sure about the legality of doing this however, so don’t do it. (Unless you know it’s legal).