CODEWITHSUNDEEP
tshark
Venomed
Venomed

Reputation: 135

Tshark filtering http/https get request

i need to see only HTTP GET requests HOST once (only the webpage), only from defined source ip, not other information/data.

The first request to that url.

For example:

The first packet what goes from client to server.

GET / HTTP/1.1\r\n

What filters should i add? I have tried few, but still get too much information/data...

Is there any possibilities to look HTTPS first request packet too? To see where the client is sending the request?

Upvotes: 2

Views: 9542

Answers (1)

Christopher Maynard
Christopher Maynard

Reputation: 6304

If you're on a Un*x platform, you could try something like:

tshark -r file.pcap -Y 'ip.src == 1.2.3.4 and http.request.method == "GET"' -T fields -e http.request.method -e http.request.version -e http.request.uri | head -n 1

... or maybe you want to use http.request.full_uri instead of http.request.uri?

If you're on Windows, you may need to install Cygwin coreutils in order to use head, and you may have to quote things a bit differently, e.g.:

tshark -r file.pcap -Y "ip.src == 1.2.3.4 and http.request.method == \"GET\"" -T fields -e http.request.method -e http.request.version -e http.request.uri | head -n 1

For https, you'll need to decrypt the SSL. You can read how to do that on the Wireshark SSL wiki page.

Upvotes: 1

Related Questions