When at a customers review my team did some captures for many users dispersed geographically. Some users tried accessing port 80 sites that were blocked by our network proxies. How can I find all requested HTTP URLs? asked 08 Oct '13, 10:29  karl |
2 Answers:
Assuming you have a capture file, you can use tshark as follows: That will write each requested http URI to the file websites.txt answered 08 Oct '13, 12:28  beroset |
I recommend looking at the Proxy logs. Wireshark is a great tool, but sometimes there are other ways to get results faster. If you don't have access to the proxy logs you could filter on "http.request.method or http.response.code = 403" (assuming your proxy returns a 403 when the site is blacklisted; replace with whatever code yours is returning). That will give you a list of all requests and response codes, but matching them can be tedious work. answered 08 Oct '13, 12:24  Jasper ♦♦ |
I have tshark v1.8.6. I used the -R instead of -Y.