Ensure that Wireshark is configured to allow subdissectors to reassemable TCP stream.

1. Press Ctrl + Shift + P (or select Edit > Preferences)
2. In Preferences, expand Protocols and select TCP
3. Ensure allow subdissectors to reassemble tcp streams is selected.
4. Select OK.

Prior to capturing the traffic in Wireshark, it is important to recognize that if the web browser has the images cached, Wireshark will not capture the transmission of the image from the server to the client. It is typically a good idea to clear the web browsers history prior to the Wireshark capture.

Start a capture in Wireshark. Navigate to any website that has an image, and then stop the Wireshark capture. Enter HTTP in the filter to only display HTTP packets.

1. Select File > Export Objects > HTTP
2. Select Save All
3. In File Explorer, select a directory to save the images
4. Select Close

If the website is using HTTPS, the packets will be encrypted. In this scenario, it will not be possible to locate the image files.

Now, go to the directory, and the image files will be displayed.