Ask Your Question
0

Capturing HTTP headers using tshark

asked 2021-01-09 01:06:33 +0000

moraist gravatar image

How can I capture the HTTP traffic containing the header information using tshark in realtime?

edit retag flag offensive close merge delete

Comments

You mention "capture" and "realtime" in the same sentence.

Are you looking to capture HTTP and write them to a file for later analysis or
do you want to capture only HTTP packets and decode them to the screen or a pipe?

Chuckc gravatar imageChuckc ( 2021-01-09 01:35:30 +0000 )edit

Hi Chuck,

My first option is showing the HTTP header while the client is accessing the web server. But if it is not possible to do that in realtime, I can capture the traffic to the file and apply some filter to get the HTTP headers.

moraist gravatar imagemoraist ( 2021-01-09 01:39:58 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-01-09 02:04:25 +0000

Chuckc gravatar image

updated 2021-01-09 02:04:58 +0000

(tshark man page)
The Windows machine I ran it on has many interfaces (-i 5). Pick an appropriate interface on your system.

C:\>tshark -i 5 -Y http -O http
Capturing on 'Ethernet'
Frame 12: 594 bytes on wire (4752 bits), 594 bytes captured (4752 bits) on interface \Device\NPF_{xxx}, id 0
Ethernet II, Src: xx:xx:xx:xx:xx:xx, Dst: xx:xx:xx:xx:xx:xx
Internet Protocol Version 4, Src: 192.168.xxx.xxx, Dst: 192.168.xxx.xxx
Transmission Control Protocol, Src Port: 29526, Dst Port: 80, Seq: 1, Ack: 1, Len: 540
Hypertext Transfer Protocol
    GET / HTTP/1.1\r\n
        [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
            [GET / HTTP/1.1\r\n]
            [Severity level: Chat]
            [Group: Sequence]
        Request Method: GET
        Request URI: /
        Request Version: HTTP/1.1
<snip>
edit flag offensive delete link more

Comments

Thanks, Chuckc

moraist gravatar imagemoraist ( 2021-01-09 02:06:38 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-01-09 01:06:33 +0000

Seen: 770 times

Last updated: Jan 09