 | 1 | initial version |
https://ask.wireshark.org/question/11887/tshark-get-only-application-level-data-bytes/
"For TCP, there is the field tcp.payload which is the TCP segment (payload) of the packet, regardless of the upper layer protocol." - SYN-bit
https://www.wireshark.org/docs/man-pages/wireshark-filter.html
Also possible to search the entire frame - frame contains "http"
And in the Wireshark GUI, select Edit->Find Packet ....
Change Display Filter to String or Regular Expression, then change Packet List to Packet Bytes.
