how to get the x-cache field in tshark ?

Question

hi I have a pcap file with some packets coming from squid cache. looking at wireshark, I can view the x-cache header under the HTTP section. however, I can not find an equivalent field for tshark . I have tried composing a lua listener to extract the info myself , but the tvb field is NIL for all packets . can anyone help ?

Accepted Answer

You can add custom http header fields to the HTTP preferences setting, which will then allow you to access them (also as a filter, which won't be available without adding it to the preferences first). Gerald wrote an answer to a similar question here, which might help:

http://ask.wireshark.org/questions/816/tshark-custom-http-headers

Answer 2

X-Cache is not a filterable field, but you can use TShark and awk or grep:

$ tshark -r clmt_04.pcap -R "http contains X-" -O http -V | awk '/X-/ {print}' > X-.txt
$ tshark -r clmt_04.pcap -R "http contains X-" -O http -V | awk '/X-Cache/ {print}' > X-Cache1.txt
$ tshark -r clmt_04.pcap -R "http contains X-" -O http -V | grep X-Cache > X-Cache2.txt