 | 1 | initial version |
http.response_for.uri is a calculated field populated during the second pass. A 2-pass analyses cannot be combined with live capture.
Instead of using a field in the http response referring to the request, you can also use the field(s) from the actual http request:
tshark -i 4 -T fields -e http.request.full_uri -Y "http.request and http"
| | 2 | No.2 Revision |
http.response_for.uri is a calculated field populated the second pass. A 2-pass analyses cannot be combined with live capture.capture. Are you capturing encrypted streams (https)?
Instead of using a field in the http response referring to the request, you can also use the field(s) from the actual http request:
tshark -i 4 -T fields -e http.request.full_uri -Y "http.request and http"
