I tried something like that, and it would seem that ethereal barfed because the file was too large for its likes. The iso that I'm trying to reconstruct is ~200M. As a sanity check, I sent a small jpeg over HTTP (just a few K), used the "Follow TCP Stream" functionality in Ethereal, and the wrote a Perl script to strip the headers off the top of the file. The jpeg image came out looking fine. When I say that ethereal "barfed" in the former case, what I mean is that for some reason it exported a file that was only 2.5M in size when it ought to have been 100x larger. I wonder if I've bumped up against a buffer size for ethereal... I'll look into using tcpflow to successfully perform exportation. Thanks.