 | 1 | initial version |
$ tshark -r ./ultpcap2.pcapng -Y "frame contains \"http\"" | wc
105 1589 16286
$ tshark -r ./ultpcap2.pcapng -Y "tcp contains \"http\"" | wc
59 802 7940
The search string needs double quotes that are "escaped" since the string passed to -Y also needs quotes.
Brief discussion here in a question about tshark.